Sudden error (403-Forbidden) on Firestore calls

Question

I have this simple code using Firestore-PHP

<?php

require 'vendor/autoload.php';
use Google\Cloud\Firestore\FirestoreClient;

putenv('GOOGLE_APPLICATION_CREDENTIALS='.realpath("key.json"));

$db = new FirestoreClient();

$docRef = $db->collection('orders')->document('1562292363537');
$snapshot = $docRef->snapshot();

?>

All my PHP calls to Firestore started getting this error suddenly: (403:Forbidden)

Uncaught Google\Cloud\Core\Exception\ServiceException: {
    "message": "403:Forbidden",
    "code": 14,
    "status": "UNAVAILABLE",
    "details": [
        {
            "@type": "content-length",
            "data": "0"
        },
        {
            "@type": "date",
            "data": "Sun, 12 Dec 2021 00:00:36 GMT"
        },
        {
            "@type": "alt-svc",
            "data": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\""
        }
    ]

I'm having this issue with two different projects, and using the latest Google-Cloud-SDK available.

I tried to create a new service account key with full permissions But there's no benefit.

This error started as the same time App Check started showing this graph:

Although App check is Unenforced in the settings

Is there anyway to fix this issue please ?

score 1 · Answer 1 · answered Jan 03 '22 at 22:53

1

I just ran into this problem. It was related to using an outdated firebase-admin package. Apparently without warning Google has outdated v8 and lower. You will need to upgrade your package to the latest.

npm i firebase-admin@latest

answered Jan 03 '22 at 22:53

eDriven_Levar

361
3
10

score 0 · Answer 2 · answered Dec 12 '21 at 18:03

Just a guess as I haven't seen it before but I suspect the "Unenforced" in the status of RTDB and Cloud Firestore are because of lax or missing Rules.

Ensure you have Rules set, and that they don't leave your database "wide open" from a security standpoint.

For example, if you have Allow read, write: true then your database is "wide open". At the very least you want to enforce that users be authenticated with something like: Allow read, write: if request.auth.uid != null

(Note: you can still allow Anonymous users to access your app by enabling Anonymous Authentication if Firebase Auth. Anonymous Firebase Auth users are still using "authenticated" requests)

I want to keep App Check (Unenforced).. I can activate it but that won't help me.. also editing the Rules didn't fix the issue — MujtabaFR, Dec 12 '21 at 20:36

score 0 · Answer 3 · answered Dec 13 '21 at 08:19

From your screenshot, the errors are due to outdated clients requests. Check the library you're using and make sure they're updated, according to this link on how to enable App Check in web apps.

Here are some guidelines that could be helpful for you:

If almost all of the recent requests are from verified clients, consider enabling enforcement to start protecting your backend resources.
If a significant portion of the recent requests are from likely-outdated clients, to avoid disrupting users, consider waiting for more users to update your app before enabling enforcement. Enforcing App Check on a released app will break prior app versions that are not integrated with the App Check SDK.
If your app hasn't launched yet, you should enable App Check enforcement immediately, since there aren't any outdated clients in use.

What PHP version are you using? I've tried using `export GOOGLE_APPLICATION_CREDENTIALS="path/to/your/keyfile.json"` on the terminal and it worked fine for me. As for the App Check, it's still on beta so not all languages are supported yet. — Robert G, Dec 17 '21 at 03:47

Sudden error (403-Forbidden) on Firestore calls

3 Answers3