AppCheck does not work in Pre-Launch Reports / Firebase Test Lab ?

[anhnch]

Appcheck works for iOS on real device in debug and release builld. But it doesn't work for Android in debug build and Google Play internal testing stage release build on real device. It's difficult to debug what exactly the problem is. I can't make a production release when I'm not sure.

The fingerprints are fine. I've checked carefully. I have both Play Integrity and SafetyNet in my Firebase console. I've tried to disable Play Integrity and leave only SafetyNet enabled alone, because react-native-firebase doesn't support Play Integrity by now. But it's still not working (permission-denied error).

I've tried to install the internal testing version to many devices, but it's still permission-denied.

• So the question is does Appcheck work with Android Internal | Closed | Open testing version on real device?
• And how to debug the issue?
• What are the minimum requirements on Android?

React: 17.0.2
React Native: 0.68.2
@react-native-firebase/: 15.0.0

[anhnch]

I found this https://stackoverflow.com/questions/73256195/firebase-app-check-rejecting-all-requests-from-android-devices Many people have reported the same issue.

And a guy who seems to be Firebase team member replied https://stackoverflow.com/a/72549724/219308

Thank you for bringing this to our attention. The team is aware of the issue that apps with SafetyNet may not work correctly in Pre-launch Reports (PLR)...

[mikehardy]

Based on my read of the links you posted (great links, by the way) it appears the firebase test lab is just not going to work for AppCheck without using debug tokens, that's a shame. They mention that Play Integrity will support it "soon", but even it is not supported yet.

react-native-firebase doesn't support Play Integrity at all (yet: follow #6434 for implementation as it happens) so it's all SafetyNet for us.

I'm not sure there is an action we can do in this repo that will actually solve things for you since Play Integrity would not work anyway, though support for that is important for the future

In your repo if you could send debuggable builds with a BuildConfig variable set, you can use debug tokens in that context, you'll hit this case:

react-native-firebase/packages/app-check/android/src/main/java/io/invertase/firebase/appcheck/ReactNativeFirebaseAppCheckModule.java

Lines 55 to 57 in 76100cc

	if (isDebuggable) {
	if (BuildConfig.FIREBASE_APP_CHECK_DEBUG_TOKEN != "null") {

At that point you'll get crashes on lower Android devices because of an unrelated issue until someone commits resources to solve this: #6384

So none of that is great, but it appears that for Android 9 and up at least, on debuggable builds with a build token in BuildConfig at least, AppCheck will work on any device (including Firebase Test Lab), but otherwise it won't, so you'll have to set whatever backend resources are accessed in those environments to non-enforcing