Correct way to enable App Attest provider for App Check in iOS

[xzilja]

I'm working on an app that supports iOS 14+ and it makes sense to use App Attest instead of default DeviceCheck provider in App Check.

From RNFB docs I can see that recommended way to do this is via calling native methods in AppDelegate.

I wanted to clarify how exactly this should be done i.e. which imports and methods need to be called? To start off, here is my current AppDelegate initialisation of firebase:

- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions
{
  // How to set FIRAppAttestProvider or FIRAppCheckDebugProviderFactory here and where to import these from?

  [FIRApp configure];
  
}

Ty, in advance

[mikehardy]

Hi there! You have chosen a difficult goal, if I am understanding the current state of firebase-ios-sdk + react-native-firebase AppCheck capabilities.

First, here's the best documentation on what is available:
https://firebase.google.com/docs/reference/ios/firebaseappcheck/api/reference/Classes

...of note is that they provide ProviderFactories for Debug tokens, and DeviceCheck tokens, but they do not provide an AppAttest provider factory, just the provider.

Which leads you to me note-from-the-past here:

react-native-firebase/packages/app-check/ios/RNFBAppCheck/RNFBAppCheckModule.m

Lines 110 to 116 in ef7895c

	// TODO
	// - set up DeviceCheckProvider and Debug provider
	// FIRAppCheckDebugProviderFactory *providerFactory =
	// [[FIRAppCheckDebugProviderFactory alloc] init];
	// [FIRAppCheck setAppCheckProviderFactory:providerFactory];
	// Write a custom provider factory, and allow the AppAttest provider

...where I am telling future-me or perhaps you "we need to write a custom factory for AppAttest" since apparently it's not provided and AppAttest isn't usable otherwise if I am understanding correctly

So the implementation steps are:

1. author something that implements https://firebase.google.com/docs/reference/ios/firebaseappcheck/api/reference/Protocols/FIRAppCheckProviderFactory but using the FIRAppCheckAppAttestProvider, patterned off these:

• https://github.com/firebase/firebase-ios-sdk/blob/master/FirebaseAppCheck/Sources/Public/FirebaseAppCheck/FIRDeviceCheckProviderFactory.h
• https://github.com/firebase/firebase-ios-sdk/blob/master/FirebaseAppCheck/Sources/DeviceCheckProvider/FIRDeviceCheckProviderFactory.m (I think?)

The code I linked above holding the "TODO" here in our module is how you would initialize it, prior to calling [FIRApp configure]

Note that if you were interested in doing this, my real dream is that the iOS AppCheck initialization was "delayed" just a little bit since we are not able - in interpreted languages - to delay the call to [FIRApp configure] that people put in AppDelegate as an initialization sequence thing, but I'd like for people to be able to do their fine configuration using javascript APIs, or at least firebase.json which could be package-specific and then the app-check ios module code could do things during it's init with an init provider of some sort.

Concretely what do I mean there?

It would be idea if react-native-firebase implemented an AppCheckTokenProviderFacadeFactory or similar, and used an init provider (that somehow runs before AppDelegate app launched code with FIRApp configure or just required manual integration, to install itself.

Now the dream is that within that facade, there was an implementation of a TokenProvider that was simply a facade we gave to the firebase-ios-sdk methods, and it delegated calls to the currently installed TokenProvider but allowed you to swap them via some APIs where javascript users could request (via an enum of strings or similar) the token provider factory they wanted, and it would include an AppAttestProviderFactory

That's the full dream anyway. The direct implementation of your desire is to implement AppAttestTokenProviderFactory returning already-built AppAttestTokenProvider from firebase-ios-sdk, and install that

[akeva001]

Thank you for all the help @mikehardy! Still unable to get it working even in a TestFlight build using "appAttestWithDeviceCheckFallback" as my provider. I honestly don't know what to do at this point. Been trying for months to get AppCheck working and still no progress. Everything else works great from Crashlytics to Analytics! I'll keep you posted if I figure it out in the future. Thanks again!

[akeva001]

Hey @mikehardy, so I was able to get this block of code to work and the error message is gone after I enter my debug token into the firebase console.

But when I enforce app check from the firebase console, I receive a permissions error now. Any idea what I am missing?

[mikehardy]

I'm not sure - I can say that working on github with text in triple-backticks like so:

error message here

is a lot easier than graphics, that's really hard to read. It sounds like for some reason you are not getting valid app check tokens, I just can't say why. Configuring all the relevant items in the various consoles (Apple App config, entitlements, etc etc, Firebase console, etc) is non-trivial. It's also not clear what your execution environment is. I would not expect AppAttest or DeviceCheck to work on a Simulator. I wouldn't expect AppAttest to work on an iOS13 device, etc. It's not clear what you are trying, so it's not clear why it could fail.

[akeva001]

Hi @mikehardy, so I am testing on an iOS device running iOS 16.2.

I am getting an appcheck token from const tokenFB = await firebase.appCheck().getToken();

When I enforce AppCheck on the FB console for both DB and Storage, I receive the following error on all my requests:
FirebaseError: [code=permission-denied]: Missing or insufficient permissions.

[mikehardy]

Okay, that seems like it should be a valid execution environment for the AppAttest provider (ios is 14+, you state you are on a real device). Why is your token not valid? I'm sorry, I just don't know. Some configuration issue like wrong bundle id name or wrong capitallization? Does debug provider or DeviceCheck provider work? (just curious). I'm sorry I can't say anything more specific. Seems like it should work.

[akeva001]

The debug provider does not work either. Do you think it could be because of the security rules I have set? I'll try to figure this out and keep you posted if I find a solution. Thanks @mikehardy!

[mikehardy]

You never want to run like this permanently, but you can always set an "allow everything" security rule as a DANGEROUS but TEMPORARY check just to see if it is security rules of course. Then immediately tighten the rules up again and debug them after verifying (or not) it was rules that were denying you

[akeva001]

Just tired with no luck. I just check my App Check API in the console and it seems like the requests are being made but I am not being permitted access to the DB.

[akeva001]

@mikehardy I was able to fix my issue with appcheck. Now it all works! turns out the service file was the issue!

[libero-yoko]

@akeva001
We are experiencing a very similar issue. We've noticed an excessive number of requests to ExchangeDebuToken, exceeding the 60 requests/minute quota.

Could you possibly clarify what the issue was in your service file? I'm assuming you're referring to the GoogleService-Info-[app].plist file. Thank you!

[aurelius0]

@akeva001 We are experiencing a very similar issue. We've noticed an excessive number of requests to ExchangeDebuToken, exceeding the 60 requests/minute quota.

Could you possibly clarify what the issue was in your service file? I'm assuming you're referring to the GoogleService-Info-[app].plist file. Thank you!

Hi there @libero-yoko - did you ever sort this out? I have the same problem! Thanks.