Support Auth requests when Appcheck is enabled for desktop applications#1856
Open
lalmstrom wants to merge 2 commits into
Open
Support Auth requests when Appcheck is enabled for desktop applications#1856lalmstrom wants to merge 2 commits into
lalmstrom wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
Code Review
This pull request integrates AppCheck attestation tokens into the AuthRequest constructor by fetching them via the FunctionRegistry and adding them to the request headers. Feedback suggests improving null safety for the function registry, adding more robust error and empty-token checks, and warns about the blocking nature of the Await call which could impact the UI thread if not handled in an asynchronous context.
Comment on lines
+60
to
+71
| // Add AppCheck attestation token if available. | ||
| // This is required when AppCheck enforcement is enabled on the project. | ||
| Future<std::string> app_check_future; | ||
| bool succeeded = app.function_registry()->CallFunction( | ||
| ::firebase::internal::FnAppCheckGetTokenAsync, &app, nullptr, | ||
| &app_check_future); | ||
| if (succeeded && app_check_future.status() != kFutureStatusInvalid) { | ||
| const std::string* token = app_check_future.Await(kAppCheckTokenTimeoutMs); | ||
| if (token) { | ||
| add_header("X-Firebase-AppCheck", token->c_str()); | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
There are a few improvements that should be made to this block:
- Null Safety:
app.function_registry()can returnnullptr. It should be checked before dereferencing to avoid a potential crash. - Error Handling: It is safer to check
app_check_future.error() == 0and ensure the token is not empty before adding the header. An empty or invalid token might lead to unexpected server rejections if AppCheck enforcement is enabled. - Blocking Call:
app_check_future.Await()blocks the current thread for up to 10 seconds. While this might be acceptable on a background worker thread (common for RPC construction in this SDK), it will freeze the UI if this constructor is ever invoked on the main thread. Ensure this is only called in an asynchronous context.
Suggested change
| // Add AppCheck attestation token if available. | |
| // This is required when AppCheck enforcement is enabled on the project. | |
| Future<std::string> app_check_future; | |
| bool succeeded = app.function_registry()->CallFunction( | |
| ::firebase::internal::FnAppCheckGetTokenAsync, &app, nullptr, | |
| &app_check_future); | |
| if (succeeded && app_check_future.status() != kFutureStatusInvalid) { | |
| const std::string* token = app_check_future.Await(kAppCheckTokenTimeoutMs); | |
| if (token) { | |
| add_header("X-Firebase-AppCheck", token->c_str()); | |
| } | |
| } | |
| // Add AppCheck attestation token if available. | |
| // This is required when AppCheck enforcement is enabled on the project. | |
| ::firebase::internal::FunctionRegistry* registry = app.function_registry(); | |
| if (registry) { | |
| Future<std::string> app_check_future; | |
| bool succeeded = registry->CallFunction( | |
| ::firebase::internal::FnAppCheckGetTokenAsync, &app, nullptr, | |
| &app_check_future); | |
| if (succeeded && app_check_future.status() != kFutureStatusInvalid) { | |
| const std::string* token = app_check_future.Await(kAppCheckTokenTimeoutMs); | |
| if (token && app_check_future.error() == 0 && !token->empty()) { | |
| add_header("X-Firebase-AppCheck", token->c_str()); | |
| } | |
| } | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes Auth requests when Appcheck is enabled for desktop applications. Without it, Auth requests are rejected.
Adds X-Firebase-AppCheck with token header to Authorization requests.
Testing
Have tested Auth requests in flutter application running in windows with debug tokens in firebase.
Type of Change