AppCheck with Play Integrity?

[pierroo]

Hi,

In the docs, there is only mention of safetyNet for AppCheck, but nothing about Play Integrity which seems to be the new way of Google to verify the authenticity of an app and they plan on deprecating SafetyNet.

Is there any plan to include Play Integrity in the future?

Bonus question: will Play Integrity work on huawei devices or anything that does not have google play services? :/

[mikehardy]

I can't see how that would ever work without Google Play Services (it seems to be deeply linked even down to the legalese? https://developer.android.com/google/play/integrity/terms#data-safety)

Anyway, I can see they added that about 2 months ago - https://firebase.google.com/support/release-notes/android#appcheck_v16-0-0, I haven't had a chance to wrap it up and expose it here and likely won't for a few more months. In the meantime if it's needed for your use cases I'll happily help merge a PR

[pierroo]

Thank you for this very detailed answer.

I had such high hopes that appcheck was gonna be the life saver I expected against fake API requests from hackers outside of my mobile apps; unfortunately it seems that it would come at a cost... my huwaei userbase, which is most probably 10% of them all. :/

Maybe I will have to handle it completely differently; if Huawei then use recaptcha v3 and hit a different endpoint, otherwise use appcheck and hit the normal endpoint. that seems quite ugly, but could be a good compromise until firebase looks into it I guess? (if they ever plan to? Not sure they care about huawei users; or is it actually the other way around? ^_^)

[mikehardy]

I'm not sure they plan to, this is something that others can do if really needed as well
Your idea of splitting end points is interesting that could definitely work

For attacks you can also have a "penalty box" mode, where you exponentially backoff requests from same API etc to throttle bad actors but in a way where they continue trying, just less effectively maybe. That's a classic defense against floods - don't just deny because they'll try again, make it look like they're getting through but just really slowly so you tie up their resources instead of yours

[pierroo]

This API throttling, API IP limiter etc, are all already in place.

However, when it comes to expert hackers using OpenBullets/SilverBullets that generates new IP through proxies for each request with thousands of those per seconds, there is just not much you can do besides praying or closing your API entirely until they stop. :')

That is why Firebase AppCheck seemed so promising, because at least I could make sure that those requests came from the real mobile app and not from some shady third party tool. (this, unless they can actually misuse the appcheck token for as long as its TTL doesn't expire, but that we discussed on another topic :))

[mikehardy]

If you've already gone to those lengths, it may not be that much more difficult to do something quick-and-dirty in node_modules / persisted via patch-package where you

• write the AppCheckSysIntegrityProvider (no idea on the SysIntegrity APIs, hopefully easy to use? AppCheck android providers are open source for inspiration)
• modify our android app check code to check for non-debug builds if HMS classes are available (try to class.forName them ?) and if they are install that provider not the AppCheck provider
• done?

Most (all?) of the code is structural - just binding one API to another and handling errors, it may not be too big a job

[Saran-Avinash]

Please anyone share if there is any information written for how to make app checks with play integrity api possible in react-native

[RyadhB2]

Hello, I wanted to ask if there's any new update about the subject, ie. is it planned to replace SafetyNet or add Play integrity tin the future ?

[mikehardy]

There is no news. The clock is ticking for us (or a motivated contributor from the community) to add a Play Integrity provider for react-native-firebase though. We have a few more months at least

[RyadhB2]

Thanks a lot for the fast reply 🙏🙏. We have a few more months indeed and hopefully it will be added

[RyadhB2]

Hi, any updates please ?

[mikehardy]

@RyadhB2 please follow the associated pull request, it's nearly ready #6847 - that said, this should not affect you as you have been asking since December, and the only thing that happened today is new signups are disallowed. If you've been using AppCheck since December you are still more than able to use SafetyNet.

[mo-nizar]

is there any update on this issue, i am still not able to fetch app check token from react native android application

[mikehardy]

Android Play Integrity support has been released with react-native-firebase v17!

[ledinhthi]

HI @mikehardy mike

I fetch token Android Play Integrity. but it show attestation 403 . So what should i do to get toklen?.
Thank you so much

[sachin3072004]

Hi Mike, With this change phone auth should work with the 'Play Integrity API' ? right ?

[mikehardy]

They are related but separate. It appears that phone auth may still require the device check API in order to avoid recaptcha - I apologies I don't have a moment to look right now but I know stackoverflow has a question on it related to this exact thing with steps to take including how to apply to get renewed access to the device check API for phone auth recaptcha avoidance. I think someone has put it in a related issue here as well. If you find it and paste the link here it would be a service

[sachin3072004]

Hi Mike, Thank you for your response. I am not sure if you are referring to the following link. #6974

[mikehardy]

Not quite - first - note the title of this discussion is appcheck related. You are discussing Auth, so it's not really on target for this discussion.

Play Integrity is a new system to verify a device + app installation is genuine, and is orthogonal to both AppCheck and Auth.
SafetyNet is the old system to verify a device + app installation is genuine, and is orthogonal to both AppCheck and Auth.

AppCheck can use either SafetyNet or Play Integrity to get an AppCheck token.

Firebase Auth historically has required SafetyNet to attest an app is genuine in order to avoid the reCAPTCHA. I do not believe it supports Play Integrity yet.

firebase-android-sdk will have to support Play Integrity (if it doesn't? have you asked on firebase-android-sdk repo - might be worthwhile) in order to avoid the reCAPTCHA on android now that SafetyNet is no longer allowed for projects.

Or, there is apparently a form you can submit to google related to that API on the google cloud console and they'll review the request and possibly allow you to continue using SafetyNet until firebase auth supports it.

Unfortunately, I'm not aware of anything actionable we can do here at the react-native-firebase layer. This is entirely handled at the firebase-android-sdk layer underneath us

[mikehardy]

firebase-android-sdk BoM 31.4.0 supports play integrity as the default method for phone auth, I'm working on a PR for that now and will release it shortly

[ledinhthi]

i’m still get stuck to get play intergrity token from our app on play store :((. ẽchang always be failed Vào Th 7, 25 thg 3, 2023 lúc 20:07 Mike Hardy ***@***.***> đã viết:

…

They are related but separate. It appears that phone auth may still require the device check API in order to avoid recaptcha - I apologies I don't have a moment to look right now but I *know* stackoverflow has a question on it related to this exact thing with steps to take including how to apply to get renewed access to the device check API for phone auth recaptcha avoidance. I think someone has put it in a related issue here as well. If you find it and paste the link here it would be a service — Reply to this email directly, view it on GitHub <#6345 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGFHZUWIA4RVZNNYMGKSWWDW53U2LANCNFSM5Z6DDR4A> . You are receiving this because you commented.Message ID: <invertase/react-native-firebase/repo-discussions/6345/comments/5426582@ github.com>

[ledinhthi]

Great, thanks for the update. Vào Th 5, 6 thg 4, 2023 lúc 05:06 Mike Hardy ***@***.***> đã viết:

…

firebase-android-sdk BoM 31.4.0 supports play integrity as the default method for phone auth, I'm working on a PR for that now and will release it shortly — Reply to this email directly, view it on GitHub <#6345 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGFHZUTXHGYZ64MYDX66QD3W7XUG3ANCNFSM5Z6DDR4A> . You are receiving this because you commented.Message ID: <invertase/react-native-firebase/repo-discussions/6345/comments/5537319@ github.com>

[dev007github]

Hi,
lots of otp auth issues facing in android (ios working fine) after upgrading package to the latest version. please help..

previously used version
"@react-native-firebase/app": "^17.3.0",
"@react-native-firebase/app-check": "^17.0.0",
"@react-native-firebase/auth": "^16.1.1",

current version
"@react-native-firebase/app": "^17.4.2",
"@react-native-firebase/app-check": "^17.4.2",
"@react-native-firebase/auth": "^17.4.2",

app check code

**let rnfbProvider = firebase
.appCheck()
.newReactNativeFirebaseAppCheckProvider();

  rnfbProvider.configure({
    android: {
      provider: 'playIntegrity',
    },
    apple: {
      provider: 'appAttestWithDeviceCheckFallback',
    },
    web: {
      provider: "reCaptchaV3",
      siteKey: "unknown",
    },
  });

  firebase
    .appCheck()
    .initializeAppCheck({
      provider: rnfbProvider,
      isTokenAutoRefreshEnabled: true,
    });**

issue:
in simulator some times getting error like "this app is not authorized to use firebase authentication...." but already registered playintegrity in firebase and added sha1 and sha64... some times auth working with browser recaptcha flow.

in real device auth working with browser recaptcha flow.. but previously otp sms format was currect in release version.. but now otp contains firebase project url in release version..

My previous app version is still working fine for otp auth...so I tried to revert above package versions.. but no luck..same issue...
any solution for this issue?

[Sameed1998]

Have you integrated the play integrity api in react native?

[hanykumar]

Hi, I face issue implementing Play Integrity App check in bare react native project.

I added this in app.tsx file.

const appCheckFunction = async () => {
try {
let rnfbProvider = AppCheck().newReactNativeFirebaseAppCheckProvider();

  rnfbProvider.configure({
    android: {
      provider: 'playIntegrity',
    },
  });

  await AppCheck().initializeAppCheck({
    provider: rnfbProvider,
    isTokenAutoRefreshEnabled: true,
  });


  const appCheckToken = await AppCheck().getToken();
  console.log('AppCheck Token:', appCheckToken);
} catch (error) {
  console.error('Error initializing or getting AppCheck token:', error);
}

};

appCheckFunction();

added deps in app/build.gradle file.
implementation platform('com.google.firebase:firebase-bom:32.7.0')
implementation("com.google.firebase:firebase-appcheck")
implementation("com.google.android.play:integrity:1.3.0")
implementation("com.google.firebase:firebase-appcheck-playintegrity")

google-service.json file is included.
playIntegration is enabled in firebase as well with sha keys.

But still it gives error
ERROR Error initializing or getting AppCheck token: [Error: [appCheck/token-error] com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed.]

on this line
const appCheckToken = await AppCheck().getToken();
console.log('AppCheck Token:', appCheckToken);

Any help would be grateful.
Thanks

[mikehardy]

Hi there!

implementation platform('com.google.firebase:firebase-bom:32.7.0')
implementation("com.google.firebase:firebase-appcheck")
implementation("com.google.android.play:integrity:1.3.0")
implementation("com.google.firebase:firebase-appcheck-playintegrity")

Please don't do that. @react-native-firebase/app expects to control the firebase-bom version, and @react-native-firebase/app-check controls all the needed dependencies for app-check.

You should remove all of those dependency lines.

ERROR Error initializing or getting AppCheck token: [Error: [appCheck/token-error] com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed.]

That means app attestation failed. There are many reasons for that. Did you see anything else in the logs? Have you made sure the APIs are enabled on the google side? This looks like it will likely be a project configuration error vs a react-native-firebase error

[sunilanumolu]

@hanykumar hey, did u find any solution for this issue? TIA