App Check in Flutter doesn't work with Firebase Storage

[ThomasGysemans]

I've once again a problem with Flutter and Firebase. I have created a whole new project entitled "test_app_check".

I have followed the steps of installation for a Firebase project as usual and I have initialized Firebase Authentication, Firebase Storage and App Check. I have enforced App Check on the storage feature.

Here is my code:

• main.dart

import 'dart:convert';
import 'dart:typed_data';

import 'package:firebase_app_check/firebase_app_check.dart';
import 'package:firebase_auth/firebase_auth.dart';
import 'package:firebase_core/firebase_core.dart';
import 'package:firebase_storage/firebase_storage.dart';
import 'package:flutter/material.dart';
import 'package:flutter/services.dart';

void main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp();
  await FirebaseAppCheck.instance.activate();

  runApp(const MyApp());
}

class MyApp extends StatelessWidget {
  const MyApp({Key? key}) : super(key: key);

  @override
  Widget build(BuildContext context) {
    return MaterialApp(
      title: 'Flutter Demo',
      debugShowCheckedModeBanner: false,
      theme: ThemeData(
        primarySwatch: Colors.blue,
      ),
      home: const MyHomePage(),
    );
  }
}

class MyHomePage extends StatefulWidget {
  const MyHomePage({Key? key}) : super(key: key);

  @override
  State<MyHomePage> createState() => _MyHomePageState();
}

class _MyHomePageState extends State<MyHomePage> {
  final FirebaseStorage storage = FirebaseStorage.instance;

  final FirebaseAuth auth = FirebaseAuth.instance;

  Future<dynamic> getJSONFile(String path) async {
    try {
      Reference ref = storage.ref(path);
      Uint8List? downloadedData = await ref.getData();
      print("downloadedData: $downloadedData");
      if (downloadedData != null) {
        String content = const Utf8Codec().decode(downloadedData.toList());
        return jsonDecode(content);
      } else {
        return false;
      }
    } on PlatformException {
      return false;
    }
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      appBar: AppBar(
        title: const Text("Test App Check"),
      ),
      body: Column(
        children: [
          FutureBuilder(
            future: auth.signInAnonymously(),
            builder: (_, AsyncSnapshot data) {
              switch (data.connectionState) {
                case ConnectionState.done:
                  if (data.hasError) {
                    return Text("Error: ${data.error}");
                  } else {
                    print("User is authenticated");
                    return FutureBuilder(
                      future: getJSONFile("data_firebase_storage.json"),
                      builder: (_, AsyncSnapshot data) {
                        switch (data.connectionState) {
                          case ConnectionState.done:
                            if (data.hasError) {
                              return Text("Error: ${data.error}");
                            } else {
                              return Text("Data: ${data.data}");
                            }
                          default:
                            return const CircularProgressIndicator();
                        }
                      },
                    );
                  }
                default:
                  return const CircularProgressIndicator();
              }
            },
          ),
        ],
      ),
    );
  }
}

• pubspec.yaml:

name: test_app_check
description: A new Flutter project.

publish_to: "none"

version: 1.0.0+1

environment:
  sdk: ">=2.12.0 <3.0.0"

dependencies:
  flutter:
    sdk: flutter

  cupertino_icons: ^1.0.2
  firebase_core: ^1.10.6
  firebase_auth: ^3.3.4
  firebase_app_check: ^0.0.6+3
  firebase_storage: ^10.2.4

dev_dependencies:
  flutter_test:
    sdk: flutter

  flutter_lints: ^1.0.0

flutter:
  uses-material-design: true

• android\app\src\main\kotlin\com\example\test_app_check\MainActivity.kt:

package com.example.test_app_check

import io.flutter.embedding.android.FlutterActivity
import android.os.Bundle
import com.google.firebase.FirebaseApp
import com.google.firebase.appcheck.FirebaseAppCheck
import com.google.firebase.appcheck.safetynet.SafetyNetAppCheckProviderFactory

class MainActivity: FlutterActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        FirebaseApp.initializeApp(/*context=*/this)
        val firebaseAppCheck = FirebaseAppCheck.getInstance()
        firebaseAppCheck.installAppCheckProviderFactory(
            SafetyNetAppCheckProviderFactory.getInstance()
        )
        super.onCreate(savedInstanceState)
    }
}

• android\app\build.gradle:

// the usual ...
// with
minSdkVersion 21
targetSdkVersion 30

// and at the end
dependencies {
    implementation platform('com.google.firebase:firebase-bom:29.0.3')
    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version"
    implementation 'com.google.firebase:firebase-appcheck-safetynet:16.0.0-beta04'
}

• android\build.gradle:

// the usual plus this, as asked by google:
classpath 'com.google.gms:google-services:4.3.10'

When I run the code, I have this:

I/flutter (31101): User is authenticated
W/StorageUtil(31101): Error getting App Check token; using placeholder token instead. Error: com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed.
D/StreamDownloadTask(31101): Initial opening of Stream failed
D/StreamDownloadTask(31101): java.io.IOException: Could not open resulting stream.
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StreamDownloadTask.createDownloadStream(StreamDownloadTask.java:145)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StreamDownloadTask.access$000(StreamDownloadTask.java:36)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StreamDownloadTask$1.call(StreamDownloadTask.java:167)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StreamDownloadTask$1.call(StreamDownloadTask.java:164)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StreamDownloadTask$StreamProgressWrapper.ensureStream(StreamDownloadTask.java:325)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StreamDownloadTask$StreamProgressWrapper.access$100(StreamDownloadTask.java:262)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StreamDownloadTask.run(StreamDownloadTask.java:175)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.StorageTask.lambda$getRunnable$7$StorageTask(StorageTask.java:1072)
D/StreamDownloadTask(31101): 	at com.google.firebase.storage.-$$Lambda$StorageTask$q9YBoR_A8LB-JxTCx8JRQvabaZs.run(Unknown Source:2)
D/StreamDownloadTask(31101): 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
D/StreamDownloadTask(31101): 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
D/StreamDownloadTask(31101): 	at java.lang.Thread.run(Thread.java:923)
E/StorageException(31101): StorageException has occurred.
E/StorageException(31101): User is not authenticated, please authenticate using Firebase Authentication and try again.
E/StorageException(31101):  Code: -13020 HttpResult: 401
E/StorageException(31101): Could not open resulting stream.
E/StorageException(31101): java.io.IOException: Could not open resulting stream.
E/StorageException(31101): 	at com.google.firebase.storage.StreamDownloadTask.createDownloadStream(StreamDownloadTask.java:145)
E/StorageException(31101): 	at com.google.firebase.storage.StreamDownloadTask.access$000(StreamDownloadTask.java:36)

In this huge message there are two weird things: first the user is considered as "authenticated" according to my print. A few microseconds later: User is not authenticated, please authenticate using Firebase Authentication and try again. Second weird thing, I have Error getting App Check token; using placeholder token instead. Error: com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed whereas it should print the debug token as explained in the documentation...

Note:

• my rules are all set to "accept everything"
• It works without App Check... what's the problem with it?