App Check isn't compatible with firebaseUI email login

[EmilioNicolas]

Describe your environment

• Firebase UI version: latest

Describe the problem

I configured App Check in my Firebase project, but if I enable it for Authentication, Firebase UI widget is not working for login/register using email. It works for users signing with Google though.

[jhuleatt]

Thanks for reporting this, @EmilioNicolas. My hunch is that this probably has to do with the tempApp that FirebaseUI spins up internally:

firebaseui-web/javascript/widgets/authui.js

Lines 127 to 130 in 5ff6fde

	var tempApp = firebase.initializeApp({
	'apiKey': auth['app']['options']['apiKey'],
	'authDomain': auth['app']['options']['authDomain']
	}, auth['app']['name'] + firebaseui.auth.AuthUI.TEMP_APP_NAME_SUFFIX_);

Though, to confirm, when you say Gmail users, do you mean users signing in with email and password with an @gmail.com email, or users that use Sign in with Google?

[EmilioNicolas]

Thanks for your reply! I mean users signing with Google Sign In

It's a known issue and the widget does not work with Firebase App Check?

If so, Any workarounds or recommended paths to avoid registration abuse?

[jhuleatt]

Thanks for confirming that it works for Google Sign In! That is definitely strange, since if App Check works for one auth provider type I'd think it should work for all. It's not a known issue, so we'll see if we can reproduce the issue in another project.

[EmilioNicolas]

It doesn't work I'm afraid. I have integrated Cloudflare Turnstile for avoiding abuse because I couldn't use Firebase app check :-(

[yeldarby]

We're also encountering this issue. Anyone found a workaround?

[yeldarby]

@EmilioNicolas how did you get Turnstile working? We haven't been able to figure out a way to match up the user from our front-end request to the beforecreated auth trigger on the backend. We tried doing it via IP address which works for 95%+ of users but it seems many users are on network connections (like universities & companies) that round robin their IP external addresses so it's not a reliable match. And it doesn't seem there's a way to pass an identifier through the auth flow to link them to the frontend session.