Skip to content

Support Auth requests when Appcheck is enabled for desktop applications#1856

Open
lalmstrom wants to merge 2 commits into
firebase:mainfrom
lalmstrom:lalmstrom/auth_appcheck
Open

Support Auth requests when Appcheck is enabled for desktop applications#1856
lalmstrom wants to merge 2 commits into
firebase:mainfrom
lalmstrom:lalmstrom/auth_appcheck

Conversation

@lalmstrom
Copy link
Copy Markdown

Description

Fixes Auth requests when Appcheck is enabled for desktop applications. Without it, Auth requests are rejected.

Adds X-Firebase-AppCheck with token header to Authorization requests.


Testing

Have tested Auth requests in flutter application running in windows with debug tokens in firebase.


Type of Change

  • Bug fix. Add the issue # below if applicable.
  • New feature. A non-breaking change which adds functionality.
  • Other, such as a build process or documentation change.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request integrates AppCheck attestation tokens into the AuthRequest constructor by fetching them via the FunctionRegistry and adding them to the request headers. Feedback suggests improving null safety for the function registry, adding more robust error and empty-token checks, and warns about the blocking nature of the Await call which could impact the UI thread if not handled in an asynchronous context.

Comment on lines +60 to +71
// Add AppCheck attestation token if available.
// This is required when AppCheck enforcement is enabled on the project.
Future<std::string> app_check_future;
bool succeeded = app.function_registry()->CallFunction(
::firebase::internal::FnAppCheckGetTokenAsync, &app, nullptr,
&app_check_future);
if (succeeded && app_check_future.status() != kFutureStatusInvalid) {
const std::string* token = app_check_future.Await(kAppCheckTokenTimeoutMs);
if (token) {
add_header("X-Firebase-AppCheck", token->c_str());
}
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

There are a few improvements that should be made to this block:

  1. Null Safety: app.function_registry() can return nullptr. It should be checked before dereferencing to avoid a potential crash.
  2. Error Handling: It is safer to check app_check_future.error() == 0 and ensure the token is not empty before adding the header. An empty or invalid token might lead to unexpected server rejections if AppCheck enforcement is enabled.
  3. Blocking Call: app_check_future.Await() blocks the current thread for up to 10 seconds. While this might be acceptable on a background worker thread (common for RPC construction in this SDK), it will freeze the UI if this constructor is ever invoked on the main thread. Ensure this is only called in an asynchronous context.
Suggested change
// Add AppCheck attestation token if available.
// This is required when AppCheck enforcement is enabled on the project.
Future<std::string> app_check_future;
bool succeeded = app.function_registry()->CallFunction(
::firebase::internal::FnAppCheckGetTokenAsync, &app, nullptr,
&app_check_future);
if (succeeded && app_check_future.status() != kFutureStatusInvalid) {
const std::string* token = app_check_future.Await(kAppCheckTokenTimeoutMs);
if (token) {
add_header("X-Firebase-AppCheck", token->c_str());
}
}
// Add AppCheck attestation token if available.
// This is required when AppCheck enforcement is enabled on the project.
::firebase::internal::FunctionRegistry* registry = app.function_registry();
if (registry) {
Future<std::string> app_check_future;
bool succeeded = registry->CallFunction(
::firebase::internal::FnAppCheckGetTokenAsync, &app, nullptr,
&app_check_future);
if (succeeded && app_check_future.status() != kFutureStatusInvalid) {
const std::string* token = app_check_future.Await(kAppCheckTokenTimeoutMs);
if (token && app_check_future.error() == 0 && !token->empty()) {
add_header("X-Firebase-AppCheck", token->c_str());
}
}
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant