App Check

[bernardoarodrigues]

Hi @mobizt,
I am currently working on protecting my database access to only accept verified requests (from my Android app and the ESP8266), for this I'm implementing App Check to the project.
I want to know if your library currently supports the App Check verification, maybe with a custom provider which I can create or using a debug token from my Android app.
Thanks in Advance,
Bernardo

[mobizt]

That service is not available for REST API and is only for support platforms.

[bernardoarodrigues]

You create a web server, add the admin sdk, use admin.appCheck().createToken() and send the token to the client (esp8266)

[bernardoarodrigues]

The client starts using the token in every request and it will be a Verified Request

[mobizt]

The app check token is short-lived token which needed to refresh when it expired and needed other middleware to handle this which is not the design of this library to depend up on other system or platform even this required only optional request header.

This feature will not available in the library at this time.

[mobizt]

If this consider to included in the library after my intensive test I will inform you later.

[bernardoarodrigues]

Ok, thanks

[mobizt]

As this AppCheck is not supported by other non-SDK clients e.g. REST APIs client which in case of custom AppCheck provider and server, I update the library source without update the version.

The update is to add support custom X-Firebase-xxx request headers instead of add some options that related to AppCheck features as it can't be implemented in this kind of client.

You can add AppCheck header as

config.signer.customHeaders = "X-Firebase-AppCheck: <app check token>";

[bernardoarodrigues]

Ok, I appreciate your help. For the refreshing I just used a task scheduling library (as you said, other middleware needed), but the main part was adding the header to the requests so thanks