-
Notifications
You must be signed in to change notification settings - Fork 2.2k
feat(app-check): add AppCheck implementation #5581
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
8 commits
Select commit
Hold shift + click to select a range
eb75434
fix(database, android): remove System.err statement from useEmulator …
mikehardy 2c49fa5
test(apple-silicon): support arm64 arch in testing
mikehardy b06ff40
chore(template): update new-module template files to current style
mikehardy c52cba2
test(e2e, ios): use main package.json run script for tests
mikehardy 99cd4e5
feat(app-check): implement AppCheck module
mikehardy 132d54c
test(ios): increase ios pod install allowable time
mikehardy 2679aa3
test(patches): if yarn install fails (e.g., a new package) skip it gr…
mikehardy d7e3c48
test(e2e): increase e2e retries from 2 to 4
mikehardy File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| --- | ||
| title: App Check | ||
| description: Installation and getting started with App Check. | ||
| icon: //static.invertase.io/assets/social/firebase-logo.png | ||
| next: /auth/usage | ||
| previous: /analytics/screen-tracking | ||
| --- | ||
|
|
||
| # Installation | ||
|
|
||
| This module requires that the `@react-native-firebase/app` module is already setup and installed. To install the "app" | ||
| module, view the [Getting Started](/) documentation. | ||
|
|
||
| ```bash | ||
| # Install & setup the app module | ||
| yarn add @react-native-firebase/app | ||
|
|
||
| # Install the app-check module | ||
| yarn add @react-native-firebase/app-check | ||
|
|
||
| # If you're developing your app using iOS, run this command | ||
| cd ios/ && pod install | ||
| ``` | ||
|
|
||
| App Check requires you set the minimum iOS Deployment version in `ios/Podfile` to `11.0` or greater. | ||
|
|
||
| You may have Xcode compiler errors after including the App Check module, specifically referencing linker problems and missing directories. | ||
|
|
||
| You may find excluding the `i386` architecture via an addition to the `ios/Podfile` `post_install` hook like the below works: | ||
|
|
||
| ```ruby | ||
| installer.aggregate_targets.each do |aggregate_target| | ||
| aggregate_target.user_project.native_targets.each do |target| | ||
| target.build_configurations.each do |config| | ||
| config.build_settings['ONLY_ACTIVE_ARCH'] = 'NO' | ||
| config.build_settings['EXCLUDED_ARCHS'] = 'i386' | ||
| end | ||
| end | ||
| aggregate_target.user_project.save | ||
| end | ||
| ``` | ||
|
|
||
| # What does it do | ||
|
|
||
| App Check works alongside other Firebase services to help protect your backend resources from abuse, such as billing fraud or phishing. With App Check, devices running your app will use an app or device attestation provider that attests to one or both of the following: | ||
|
|
||
| - Requests originate from your authentic app | ||
| - Requests originate from an authentic, untampered device | ||
|
|
||
| This attestation is attached to every request your app makes to your Firebase backend resources. | ||
|
|
||
| <Youtube id="Fjj4fmr2t04" /> | ||
|
|
||
| This App Check module has built-in support for using the following services as attestation providers: | ||
|
|
||
| - DeviceCheck on iOS | ||
| - SafetyNet on Android | ||
|
|
||
| App Check currently works with the following Firebase products: | ||
|
|
||
| - Realtime Database | ||
| - Cloud Storage | ||
| - Cloud Functions (callable functions) | ||
|
|
||
| The [official Firebase App Check documentation](https://firebase.google.com/docs/app-check) has more information, including about the iOS AppAttest provider, and testing/ CI integration, it is worth a read. | ||
|
|
||
| # Usage | ||
|
|
||
| ## Activate | ||
|
|
||
| On iOS if you include the App Check package, it is activated by default. The only configuration possible is the token auto refresh. When you call activate, the provider (DeviceCheck by default) stays the same but the token auto refresh setting will be changed based on the argument provided. | ||
|
|
||
| On Android, App Check is not activated until you call the activate method. The provider is not configurable here either but if your app is "debuggable", then the Debug app check provider will be installed, otherwise the SafetyNet provider will be installed. | ||
|
|
||
| You must call activate prior to calling any firebase back-end services for App Check to function. | ||
|
|
||
| ## Automatic Data Collection | ||
|
|
||
| App Check has an "tokenAutoRefreshEnabled" setting. This may cause App Check to attempt a remote App Check token fetch prior to user consent. In certain scenarios, like those that exist in GDPR-compliant apps running for the first time, this may be unwanted. | ||
|
|
||
| If unset, the "tokenAutoRefreshEnabled" setting will defer to the app's "automatic data collection" setting, which may be set in the Info.plist or AndroidManifest.xml | ||
|
|
||
| ## Using App Check tokens for non-firebase services | ||
|
|
||
| The [official documentation](https://firebase.google.com/docs/app-check/web/custom-resource) shows how to use `getToken` to access the current App Check token and then verify it in external services. | ||
|
|
||
| ## Testing Environments / CI | ||
|
|
||
| App Check may be used in CI environments by following the upstream documentation to configure a debug token shared with your app in the CI environment. | ||
|
|
||
| In certain react-native testing scenarios it may be difficult to access the shared secret, but the react-native-firebase testing app for e2e testing does successfully fetch App Check tokens via: | ||
|
|
||
| - including the App Check debug test helper in the test app, along with a change to `DetoxTest` for Android | ||
| - by setting an environment variable and initializing the debug provider before firebase configure in `AppDelegate.m` for iOS. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # Built application files | ||
| android/*/build/ | ||
|
|
||
| # Crashlytics configuations | ||
| android/com_crashlytics_export_strings.xml | ||
|
|
||
| # Local configuration file (sdk path, etc) | ||
| android/local.properties | ||
|
|
||
| # Gradle generated files | ||
| android/.gradle/ | ||
|
|
||
| # Signing files | ||
| android/.signing/ | ||
|
|
||
| # User-specific configurations | ||
| android/.idea/gradle.xml | ||
| android/.idea/libraries/ | ||
| android/.idea/workspace.xml | ||
| android/.idea/tasks.xml | ||
| android/.idea/.name | ||
| android/.idea/compiler.xml | ||
| android/.idea/copyright/profiles_settings.xml | ||
| android/.idea/encodings.xml | ||
| android/.idea/misc.xml | ||
| android/.idea/modules.xml | ||
| android/.idea/scopes/scope_settings.xml | ||
| android/.idea/vcs.xml | ||
| android/*.iml | ||
|
|
||
| # Xcode | ||
| *.pbxuser | ||
| *.mode1v3 | ||
| *.mode2v3 | ||
| *.perspectivev3 | ||
| *.xcuserstate | ||
| ios/Pods | ||
| ios/build | ||
| *project.xcworkspace* | ||
| *xcuserdata* | ||
|
|
||
| # OS-specific files | ||
| .DS_Store | ||
| .DS_Store? | ||
| ._* | ||
| .Spotlight-V100 | ||
| .Trashes | ||
| ehthumbs.db | ||
| Thumbs.dbandroid/gradle | ||
| android/gradlew | ||
| android/build | ||
| android/gradlew.bat | ||
| android/gradle/ | ||
|
|
||
| .idea | ||
| coverage | ||
| yarn.lock | ||
| e2e/ | ||
| .github | ||
| .vscode | ||
| .nyc_output | ||
| android/.settings | ||
| *.coverage.json | ||
| .circleci | ||
| .eslintignore |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| Apache-2.0 License | ||
| ------------------ | ||
|
|
||
| Copyright (c) 2016-present Invertase Limited <[email protected]> & Contributors | ||
|
|
||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this library except in compliance with the License. | ||
|
|
||
| You may obtain a copy of the Apache-2.0 License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
|
|
||
|
|
||
| Creative Commons Attribution 3.0 License | ||
| ---------------------------------------- | ||
|
|
||
| Copyright (c) 2016-present Invertase Limited <[email protected]> & Contributors | ||
|
|
||
| Documentation and other instructional materials provided for this project | ||
| (including on a separate documentation repository or it's documentation website) are | ||
| licensed under the Creative Commons Attribution 3.0 License. Code samples/blocks | ||
| contained therein are licensed under the Apache License, Version 2.0 (the "License"), as above. | ||
|
|
||
| You may obtain a copy of the Creative Commons Attribution 3.0 License at | ||
|
|
||
| https://creativecommons.org/licenses/by/3.0/ |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I checked, there is no AppCheck official logo that I can find.