On Ios React Native Firebase AppCheck uses 'exchangeDebugToken' url in release build. Android is working fine.

[AmitDigga]

Refernece on stackoverflow

Running Release Build

On xcode I am using Build Configuration of Release to run app on a physical device.

Error shown in console when app starts

[javascript] [Error: [appCheck/token-error] The operation couldn’t be completed. The server responded with an error: 
 - URL: https://firebaseappcheck.googleapis.com/v1/projects/##########/apps/##########:exchangeDebugToken 
 - HTTP status code: 403 
 - Response body: {
  "error": {
    "code": 403,
    "message": "App attestation failed.",
    "status": "PERMISSION_DENIED"
  }
}
]

Look the above has exchangeDebugToken in the url

Javascript Initialization

async function initAppCheck() {
  const appcheck = firebase.appCheck();
  const rnfbProvider = appcheck
    .newReactNativeFirebaseAppCheckProvider();
  await rnfbProvider.configure({
    android: {
      provider: __DEV__ ? 'debug' : 'playIntegrity',
      debugToken: 'fba7bbac-8440-4965-b5f2-8c020bd042c3',
    },
    apple: {
      provider: 'appAttestWithDeviceCheckFallback',
    },
    web: {
      provider: 'reCaptchaV3',
      siteKey: 'unknown',
    },
  });

  await appcheck.initializeAppCheck({
    provider: rnfbProvider,
    isTokenAutoRefreshEnabled: true,
  });
  const token = await appcheck.getToken(true);
}

__DEV__ is false when logged.

Pod File:

require_relative '../node_modules/react-native/scripts/react_native_pods'
require_relative '../node_modules/@react-native-community/cli-platform-ios/native_modules'

platform :ios, min_ios_version_supported
prepare_react_native_project!
flipper_config = FlipperConfiguration.disabled 
# flipper_config = ENV['NO_FLIPPER'] == "1" ? FlipperConfiguration.disabled : FlipperConfiguration.enabled
linkage = ENV['USE_FRAMEWORKS']
if linkage != nil
  Pod::UI.puts "Configuring Pod with #{linkage}ally linked Frameworks".green
  use_frameworks! :linkage => linkage.to_sym
end

target 'BusinessClientApp' do
  config = use_native_modules!
  use_frameworks! :linkage => :static
  
  # Flags change depending on the env values.
  flags = get_default_flags()

  use_react_native!(
    :path => config[:reactNativePath],
    # Hermes is now enabled by default. Disable by setting this flag to false.
    # Upcoming versions of React Native may rely on get_default_flags(), but
    # we make it explicit here to aid in the React Native upgrade process.
    :hermes_enabled => flags[:hermes_enabled],
    :fabric_enabled => flags[:fabric_enabled],
    # Enables Flipper.
    #
    # Note that if you have use_frameworks! enabled, Flipper will not work and
    # you should disable the next line.
    :flipper_configuration => flipper_config,
    # An absolute path to your application root.
    :app_path => "#{Pod::Config.instance.installation_root}/.."
  )

  target 'BusinessClientAppTests' do
    inherit! :complete
    # Pods for testing
  end

  post_install do |installer|
    react_native_post_install(
      installer,
      # Set `mac_catalyst_enabled` to `true` in order to apply patches
      # necessary for Mac Catalyst builds
      :mac_catalyst_enabled => false
    )
    __apply_Xcode_12_5_M1_post_install_workaround(installer)
  end
end

App Delegate.mm

#import "AppDelegate.h"
#import "RNFBAppCheckModule.h" // https://rnfirebase.io/app-check/usage
#import <Firebase.h>

#import <React/RCTBundleURLProvider.h>

@implementation AppDelegate

- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions
{
  // Firebase config
  [RNFBAppCheckModule sharedInstance]; // ⬅️ ADD THIS LINE BEFORE [FIRApp configure] https://rnfirebase.io/app-check/usage

  [FIRApp configure];
  
   self.moduleName = @"BusinessClientApp";
  return [super application:application didFinishLaunchingWithOptions:launchOptions];
}

- (NSURL *)sourceURLForBridge:(RCTBridge *)bridge
{
#if DEBUG
  return [[RCTBundleURLProvider sharedSettings] jsBundleURLForBundleRoot:@"index"];
#else
  return [[NSBundle mainBundle] URLForResource:@"main" withExtension:@"jsbundle"];
#endif
}


/// This method controls whether the `concurrentRoot`feature of React18 is turned on or off.
///
/// @see: https://reactjs.org/blog/2022/03/29/react-v18.html
/// @note: This requires to be rendering on Fabric (i.e. on the New Architecture).
/// @return: `true` if the `concurrentRoot` feature is enabled. Otherwise, it returns `false`.
- (BOOL)concurrentRootEnabled
{
  return true;
}

@end

Running this on simulator also get the same error, but it opens a recaptcha page for which leads to successful sign-in. But on physical device recapcha do not open and auth/error is thrown.

[mikehardy]

(deleted comment after I realized the modular headers stuff was commented out, looking more closely now)

[mikehardy]

You may observe in the code that the iOS RNFBAppCheckProviderFactory initially configures itself for debug by default:

https://github.com/invertase/react-native-firebase/blob/main/packages/app-check/ios/RNFBAppCheck/RNFBAppCheckProviderFactory.m

However, when you call configure, in the same file you can see that it obliterates the startup/default/debug configuration with whatever you configure it with afterwards.

So, if I understand correctly - that you are seeing debug token exchange attempts even after configuring AppCheck for appAttestWithDeviceCheckFallback - I can only imagine that you have a race condition between someone using the AppCheck system and attempting to get a token before it is fully configured for appAttestWithDeviceCheckFallback vs the initial startup debug configuration

There is not enough code posted to say whether this is happening or not, as it is not a complete example (https://stackoverflow.com/help/minimal-reproducible-example) but perhaps your startup sequence is not properly awaiting on initAppCheck...

[AmitDigga]

Thank you @mikehardy. I will check this and revert if I found something.

[tarkcelk]

@AmitDigga i have encountered the same case, did you solve it ?

[tarkcelk]

@mikehardy when i look the analytic events some of the users are able to get the token but almost 95% are failing, my setup is almost same as @AmitDigga ,

app-check version: 18.4.0

[mikehardy]

@tarkcelk I'm not sure how your comment about some users getting a token and some users not getting a token relates to the discussion opened by the original poster on the topic of "I see debug configuration in release builds". They seem unrelated.

[tarkcelk]

@mikehardy because of the debug configuration in release build suppose, i tried to reproduce it in release build, it happens on first install but when i killed the app and open again, it fetches the success token

[hunterfoulk]

This is happening to me aswell exactly 1 year later, did anyone ever figure out why this happens? Thanks.

[sendyputra]

i got same error to in android

      Non-fatal Exception: io.invertase.firebase.crashlytics.a: Error: [appCheck/token-error] java.net.UnknownHostException: Unable to resolve host "firebaseappcheck.googleapis.com": No address associated with hostname
   at .<unknown>(configs:init)
   at .setCrashlyticsErrorv2(address at index.android.bundle:1:1028927)
   at .?anon_0_(address at index.android.bundle:1:2082114)
   at .throw((native):0:0)
   at .asyncGeneratorStep(address at index.android.bundle:1:426549)
   at ._throw(address at index.android.bundle:1:426866)
   at .tryCallOne(InternalBytecode.js:53:16)
   at .anonymous(InternalBytecode.js:139:27)
   at .apply((native):0:0)
   at .anonymous(address at index.android.bundle:1:185567)
   at ._callTimer(address at index.android.bundle:1:184503)
   at ._callReactNativeMicrotasksPass(address at index.android.bundle:1:184670)
   at .callReactNativeMicrotasks(address at index.android.bundle:1:186664)
   at .__callReactNativeMicrotasks(address at index.android.bundle:1:92127)
   at .anonymous(address at index.android.bundle:1:91213)
   at .__guard(address at index.android.bundle:1:91968)
   at .flushedQueue(address at index.android.bundle:1:91124)
   at .invokeCallbackAndReturnFlushedQueue(address at index.android.bundle:1:91067)

[Nehal-Zeller]

Could you share some insights here if you were able to resolve the issue? I'm running into the same issue on production. There's almost 23% of error rate.

My implementation is exactly as yours @AmitDigga

"@react-native-firebase/analytics": "^21.2.0",
 "@react-native-firebase/app": "^21.2.0",
 "@react-native-firebase/app-check": "^21.2.0",

I added log to see if app check initialisation is successful on app launch and it is.

const rnfbProvider = appCheck().newReactNativeFirebaseAppCheckProvider();
rnfbProvider.configure({
  android: {
    provider: isProduction ? 'playIntegrity' : 'debug',
    debugToken: isProduction
      ? undefined
      : envVariables.dbeugToken,
  },
  apple: {
    provider: 'appAttestWithDeviceCheckFallback',
  },
});

useEffect(() => {
    appCheck()
      .initializeAppCheck({
        provider: rnfbProvider,
        isTokenAutoRefreshEnabled: true,
      })
      .then(() => {
        sentryBreadcrumb({
          level: 'info',
          category: Logs.APP_CHECK_INITIALISED,
        });
      })
      .catch((error) => {
        sentryBreadcrumb({
          level: 'error',
          category: Logs.APP_CHECK_FAILED,
          message: error?.message,
          data: {
            error: JSON.stringify(error),
          },
        });
      });

  }, []);

[hunterfoulk]

Has anyone found a fix to this problem or the root cause? I seem to be getting the exact same problem, when downloading our app from testflight, 20% of the time on the first download we are getting a 403 error here.
`Error: [appCheck/token-error] The operation couldn’t be completed. The server responded with an error:

• URL: https://firebaseappcheck.googleapis.com/v1/projects/##########/apps/##########:exchangeDebugToken
• HTTP status code: 403
• Response body: {
  "error": {
  "code": 403,
  "message": "App attestation failed.",
  "status": "PERMISSION_DENIED"
  }
  }
  ]
  `
  This is only happening on our Release builds on IOS only.

[hunterfoulk]

I've implemented backoff retry functionality when attempting to retrive a token const token = await appcheck.getToken(false);

This seems to be a good enough solution to our case of performing 3 fetch requests on the app launch after downloading the app resulting in roughly 20% of our fresh downloads receiving the App attestation failed error.

[ariva85]

It seems that initializing appcheck with isTokenAutoRefreshEnabled: true triggers this behaviour. I'm still doing some tests but with isTokenAutoRefreshEnabled: false i do not see any request to the exchangeDebugToken endpoint. The token provided invoking the getToken method is still being refreshed when needed. i'm using a custom backend to check the validity and so far it looks like it is been refreshed automatically before the previous token expires. I did not test how android behaves yet with this change.

UPDATE: sadly this morning i restarted testing and the request to the exchangeDebugToken has been fired again on a fresh reinstall (it did not happen yesterday with the same operations)

[brianGammon]

I've had successful enforcement of AppCheck on Storage and Cloud Functions, but could never get below 20% unverified requests for RTDB. I decided to try isTokenAutoRefreshEnabled: false on iOS based on @ariva85's comment above, and it seems to be working for me. With this change deployed, I am seeing it finally get close to 0%.

My 403 ExchangeDebugToken error graph:

My AppCheck graph for RTDB:

I plan to enable enforcement in a few days. Not sure if fresh installs are an issue, but given that I've had successful enforcement on services other than RTDB, it feels to me like this is some kind of a weird issue with the way the RTDB SDK works with websockets for listening.