androidfirebasefirebase-app-check

Firebase Appcheck refuse request for some users

I recently received notifications from some users indicating that my application is not working. This issue has resulted in many uninstallations. After analyzing the problem, it was identified that Appcheck is blocking users from accessing the database .

I've attached a screenshot displaying unverified and invalid requests, and I'm uncertain why this occurs randomly. I've upgraded the SDK, but the issue persists.

enter image description here

   implementation platform('com.google.firebase:firebase-bom:32.7.3')
   implementation 'com.google.firebase:firebase-appcheck-playintegrity'
   implementation 'com.google.firebase:firebase-appcheck-debug'

I'm initializing my FirebaseAppCheck in my Application classe this way as documentation said :

    FirebaseApp.initializeApp(getApplicationContext());
    FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();
    firebaseAppCheck.installAppCheckProviderFactory(
            PlayIntegrityAppCheckProviderFactory.getInstance());

I've extensively researched this issue, but unfortunately, I haven't been able to find a definitive solution. This is particularly distressing as it's impacting my user base, with a loss of more than 200 users per week. I'm still actively seeking a resolution and any assistance would be greatly appreciated

Edit :

i could reproduce the issue on my device , here is the log message :

Firebase Database connection was forcefully killed by the server. Will not attempt reconnect. Reason: Invalid appcheck token

The issue is from version installed from play store , i also tried on another device , and it works ! that's really distressing

Solution

  • I finally resolved the issue after contacting the Firebase support team. We realized that it was a device integrity issue . the device where i got this message :

    Reason: Invalid appcheck token

    has only the MEETS_BASIC_INTEGRITY integrity verdict, while my Play Integrity API was only accepting MEETS_DEVICE_INTEGRITY. This explains why my application was working on the second device. Here are two captures to illustrate the difference.

    Capture 1 : device refused to connect

    enter image description here

    Capture 2 : device connected succesfully

    enter image description here

    So to resolve this , i added MEETS_BASIC_INTEGRITY into Play Integrity API verdict

    Play Console -> Application -> App integrity -> Play Integrity Api settings

    then check MEETS_BASIC_INTEGRITY and save .

    enter image description here

    I also checked MEETS_STRONG_INTEGRITY , and the settings will result like this :

    enter image description here

    So now that the issue is resolved, you still need to be aware that according to Firebase, opting into this lower level of label does come with a cost of decreased security and should be enabled with caution.

    I invite you to read more about Integrity verdicts