Clarification for installing App Check

[dochonglo]

Hey all! :)

I've followed the installation guide for adding App Check to my project.

# Install the app-check module
yarn add @react-native-firebase/app-check

# If you're developing your app using iOS, run this command
cd ios/ && pod install

The library has been successfully installed. However, when reading further into the directions, specifically the "Usage" section, the documentation states that "on iOS if you include the App Check package, it is activated by default." I'm not sure what "activated by default means."

Does this mean that we simply need to add import @react-native-firebase/app-check in our App.js, and we're good to go?

I'd appreciate any help -- thanks!!

[mikehardy]

yep! the devicecheck provider auto-installs itself in the umderlying sdk

react-native-firebase/packages/app-check/ios/RNFBAppCheck/RNFBAppCheckModule.m

Lines 49 to 50 in 42f6d96

	// So in react-native-firebase we will only use this to set the isTokenAutoRefreshEnabled
	// parameter, but if AppCheck is included on iOS it wlil be active with DeviceCheckProviderFactory

[dochonglo]

@mikehardy - Even after doing a fresh install, I'm still experiencing the same error while using a physical device. After checking the console, all my requests are 100% unverified: invalid requests.

Just to double check, in addition to installing the library using the following steps: yarn add @react-native-firebase/app-check and pod install, do we need to configure App Check in the Firebase console like in the screenshot below? Specifically, do we need to do it for web as this is a React Native app?

What's more where can I find the repo for the e2e app you're referring to? Also, with App Check now enabled, do we need to change the way that we are writing Firebase queries on the front-end?

Finally, after searching through past issues, I found the following: #6021. In this post, OP mentioned that he added "App Check" in the Xcode Signing and Capabilities. I don't recall seeing this in the setup documentation (https://rnfirebase.io/app-check/usage). Is those something I need to implement? If so, my team ID in Xcode changes and it doesn't match the team ID in my App Store Connect account.

[mikehardy]

I don't recall seeing this in the setup documentation (https://rnfirebase.io/app-check/usage). Is those something I need to implement? If so, my team ID in Xcode changes and it doesn't match the team ID in my App Store Connect account.

This wording is not strong enough in our docs:

The official Firebase App Check documentation has more information, including about the iOS AppAttest provider, and testing/ CI integration, it is worth a read.

There are a few steps to do in order to get it working, where the steps are configuration on the Apple site and then taking the key from apple site to Firebase config site --> https://firebase.google.com/docs/app-check/ios/devicecheck-provider#project-setup

I'll peel this to an issue to make the docs more explicit, sorry for the confusion

If your team changes I suppose you'll need to work out some sort of multi-team configuration or similar. I personally use Fastlane for this sort of thing, and have a production config, and a development config with fully separate firestore apps they connect to, and I have the development firestore backend set to non-enforcing so the config isn't truly correct but I can test fine. Unfortunately I cannot really provide advice here - configuration of Xcode teams etc is definitely project specific, We could work together though to share whatever you learn in the form of better/updated docs here on the rnfirebase.io docs site

[mikehardy]

issue from comment: #6252

[dochonglo]

Hey @mikehardy - Thanks for raising this up.

After messing around with trying to understand where things may have gone wrong in the installation process, I tried a left-field approach.

After adding App Check and Device Check to my project, I noticed that the GoogleService-Info.plist file that was already in my project was different from what was in the Firebase console. Specifically, the App ID was different.

I don't know if adding App Check and Device Check makes some changes in the background around this. But below are the steps that I did to get my project working and to avoid the Error: [firestore/permission-denied] The caller does not have permission to execute the specified operation error.

1. Add the App Check package using yarn add @react-native-firebase/app-check
2. Set the minimum iOS version to be 11.0 in the Podfile.
3. Created a Key in Apple Developer Console with DeviceCheck and App Attest.
4. Enabled DeviceCheck in Firebase console Project settings with Key ID and Team ID
5. Added App Attest and Device Check in the Firebase console.
6. Enforced Cloud Storage and Firestore to use App Check.
7. In my main app target, I added the capability for App Attest in Xcode Signing & Capabilities
8. Finally, I needed to remove the GoogleService-Info.plist file from my project, redownload it again for the Firebase console, and add it to my project.
9. Clean the project, build it, and run it.

I hope this helps someone!

[mikehardy]

Interesting - there's no reason the app id changes, that's not something that happens. I wonder if you have open security rules so everything was allowed, and only with AppCheck was there any restriction at all, forcing a fix of both app id and getting the app check token correct? Just a thought.

I will note that we do not directly support AppAttest yet, there is one success report of someone getting it going but it requires some Objective-C work to bridge it in: #6163 - specifically #6163 (reply in thread)

AppCheck is still relatively new, we've had it in place for a while but it only just now came out of beta, and we have a ways to go before it's a really smooth well-documented experience, thanks for working through it with us and documenting the steps that worked