flutterfirebaserecaptchafirebase-app-check

App check on flutter web - debug token not working

My AppCheck debug token is statically set, and was added to my account under "Manage debug tokens" for my webapp:

Debug token management screen recaptcha enabled screen

Both reCAPTCHA and reCAPTCHA Enterprise are enabled.

My code is as follows:

On main.dart:

await Firebase.initializeApp(options: options);
await FirebaseAppCheck.instance.activate(
  webProvider: ReCaptchaV3Provider(reCaptchaSiteKey));

On index.html, in the <head>:

<script>self.FIREBASE_APPCHECK_DEBUG_TOKEN = "xxx-xxx-xxx";</script>

When the app initializes it says:

App Check debug token: xxx-xxx-xxx. You will need to add it to your app's App Check settings in the Firebase console for it to work.

Indicating that the SDK correctly read the debug token.

However, when I try to do any firebase / firestore operation, or even get the token using FirebaseAppCheck.instance.getToken(), it shows a 403 error in the console:

[app-check/fetch-status-error] AppCheck: Fetch server returned an HTTP error status. HTTP status: 403.

Theoretically, everything is set up correctly - with the static token recognized and the token set in the Firebase console. It is happening for two weeks - longer than propagation time, I've attempted switching between reCAPTCHA and Enterprise (not that I think it matters) both on Google's console and in local code, and running latest firebase_app_check @ 0.3.2+3.

What did I do to deserve this?

Solution

  • According to official Firebase support, this is a bug in the Flutter SDK.

    A fix should be uploaded in the upcoming release.