[READ] Step 1: Are you in the right place?
This report concerns SDK-generated diagnostics and an SDK dependency constraint, supported by caller traces and exact published artifact inspection. Please route the closed-source Auth/Play Services findings if they require a different Firebase support component. No application credentials or raw account logs are attached.
[REQUIRED] Step 2: Describe your environment
- Android Studio: AI-251.25410.109.2511.13752376; builds performed through Gradle CLI / JBR javac 21.0.6.
- Firebase components: Auth, Remote Config/ABT and Analytics.
- Samsung SM-S938U, Android 16, Google Play Services 26.32.34 (260400-968093310), Firebase BoM 34.15.0, Auth 24.1.0, Analytics 23.2.0, Remote Config 23.1.0, React Native Firebase 25.1.0. Distribution is a signed, non-debuggable direct APK. Authentication and protected application requests complete successfully. These logs still block our runtime acceptance.
[REQUIRED] Step 3: Describe the problem
Steps to reproduce
- Use the above SDK graph in a signed Android app with a persisted authenticated session.
- Cold-start the app and capture its process logs through token refresh and foreground use.
- Observe the nullable locale-header warning and the measurement/broker diagnostics below, while authenticated requests still succeed.
The Auth 24.2.0 observation below is artifact inspection only, not a claim of device reproduction on 24.2.0. The Analytics-exclusion experiment was rejected from source evidence before installation; its predicted ABT warning is not presented as a captured device result.
Relevant code / caller evidence
Auth sends a null optional locale header
During persisted-session token refresh Android logs:
Ignoring header X-Firebase-Locale because its value was null.
A temporary diagnostic build forwarding every original log entry traced this to the Firebase Auth internal request builder calling HttpsURLConnectionImpl.setRequestProperty, then Android Platform.logW. Setting the public Auth language code before React startup did not eliminate the warning. That experiment and all probe code were removed.
Inspection of the published Auth 24.1.0 and 24.2.0 class files finds the same unconditional URLConnection.setRequestProperty("X-Firebase-Locale", nullableField) call. The builder also resets that field to null after preparing the request. The internal classes are zzaem in 24.1.0 and zzafj in 24.2.0 under com.google.android.gms.internal.firebase-auth-api.
Requested correction: omit the optional locale header when its value is null, preserving a supplied locale and all authentication/App Check headers. Please confirm the expected public API behavior during token refresh and identify a fixed SDK version.
Measurement and broker diagnostics
Cold startup and foreground use also produce an empty classloader-path warning, a missing resource package 6a / resource 0x6a0b0013, and GoogleApiManager broker SecurityException naming com.google.android.gms, with Phenotype/FlagStore retries. ProviderInstaller cannot load its remote module, then installs AndroidOpenSSL through CompatProvider.
The caller traces identify:
- measurement initialization → DynamiteModule → DynamiteLoaderV2 → Android DexPathList for the empty path;
- remote measurementdynamite 26.32.34 →
Resources.getResourcePackageName for the missing resource;
- Google Play Services' internal HandlerThread for the broker error.
Analytics arrives through Remote Config's npm peer dependency and Android autolinking. An experimental exclusion removed all measurement dependencies, but we rejected it before installation: Remote Config 23.1.0 calls FirebaseABTesting.replaceAllExperiments even for an empty experiment list, ABT 21.1.1 rejects an absent AnalyticsConnector, and Remote Config logs a new warning. The live Remote Config template has no parameters, targeting conditions or personalization. The supported original dependency graph is retained.
Requested correction: identify the Google Play Services/measurement fix or supported integration correction for these diagnostics; clarify how basic Remote Config activation should work without Analytics when no experiments or Analytics-based targeting are configured. No broad log suppression or security-provider bypass is requested.
This report deliberately separates the Auth header defect from the measurement/broker findings; maintainers may route them to separate issues. No claim is made that a successful request resolves the logged failures.
[READ] Step 1: Are you in the right place?
This report concerns SDK-generated diagnostics and an SDK dependency constraint, supported by caller traces and exact published artifact inspection. Please route the closed-source Auth/Play Services findings if they require a different Firebase support component. No application credentials or raw account logs are attached.
[REQUIRED] Step 2: Describe your environment
[REQUIRED] Step 3: Describe the problem
Steps to reproduce
The Auth 24.2.0 observation below is artifact inspection only, not a claim of device reproduction on 24.2.0. The Analytics-exclusion experiment was rejected from source evidence before installation; its predicted ABT warning is not presented as a captured device result.
Relevant code / caller evidence
Auth sends a null optional locale header
During persisted-session token refresh Android logs:
A temporary diagnostic build forwarding every original log entry traced this to the Firebase Auth internal request builder calling
HttpsURLConnectionImpl.setRequestProperty, then AndroidPlatform.logW. Setting the public Auth language code before React startup did not eliminate the warning. That experiment and all probe code were removed.Inspection of the published Auth 24.1.0 and 24.2.0 class files finds the same unconditional
URLConnection.setRequestProperty("X-Firebase-Locale", nullableField)call. The builder also resets that field to null after preparing the request. The internal classes arezzaemin 24.1.0 andzzafjin 24.2.0 undercom.google.android.gms.internal.firebase-auth-api.Requested correction: omit the optional locale header when its value is null, preserving a supplied locale and all authentication/App Check headers. Please confirm the expected public API behavior during token refresh and identify a fixed SDK version.
Measurement and broker diagnostics
Cold startup and foreground use also produce an empty classloader-path warning, a missing resource package
6a/ resource0x6a0b0013, and GoogleApiManager brokerSecurityExceptionnamingcom.google.android.gms, with Phenotype/FlagStore retries. ProviderInstaller cannot load its remote module, then installs AndroidOpenSSL through CompatProvider.The caller traces identify:
Resources.getResourcePackageNamefor the missing resource;Analytics arrives through Remote Config's npm peer dependency and Android autolinking. An experimental exclusion removed all measurement dependencies, but we rejected it before installation: Remote Config 23.1.0 calls
FirebaseABTesting.replaceAllExperimentseven for an empty experiment list, ABT 21.1.1 rejects an absent AnalyticsConnector, and Remote Config logs a new warning. The live Remote Config template has no parameters, targeting conditions or personalization. The supported original dependency graph is retained.Requested correction: identify the Google Play Services/measurement fix or supported integration correction for these diagnostics; clarify how basic Remote Config activation should work without Analytics when no experiments or Analytics-based targeting are configured. No broad log suppression or security-provider bypass is requested.
This report deliberately separates the Auth header defect from the measurement/broker findings; maintainers may route them to separate issues. No claim is made that a successful request resolves the logged failures.