The SafetyNet Attestation API is being discontinued and replaced by the new Play Integrity API

[angjelkom]

Bug report

CHECKLIST

• [x] I have read the issue reporting guidelines

• [x] I confirm this is a suspected bug or issue that will affect other users

• [x] I have reproduced the issue using the example project or provided the necessary information to reproduce the issue.

• [x] I have read the documentation thoroughly and it does not help solve my issue.

• [x] I have checked that no similar issues (open or closed) already exist.

Current behavior:

The FireabseAuth v21 has dependency on SafetyNet, which according to Google has been discontinued:

+--- com.google.firebase:firebase-auth:21.0.1
|    +--- com.google.android.gms:play-services-safetynet:17.0.0

And when uploading new version in Play Console we get:

Critical issues have been reported with the following SDK versions:

com.google.android.gms:play-services-safetynet:17.0.0

What the SDK developer told us:The SafetyNet Attestation API is being discontinued and replaced by the new Play Integrity API. Begin migration as soon as possible to avoid user disruption. The Play Integrity API includes all the integrity signals that SafetyNet Attestation offers and more, like Google Play licensing and better error messaging. Learn more and start migrating at

Expected behavior:

No Warnings in Play Console

Steps to reproduce:

• Install latest stable fireabsex v14.1.0
• check dependencies by running: ./gradlew app:dependencies

Screenshots

Environment information

• Cordova CLI version
  • cordova -v 11.0.0
• Cordova platform version
  • cordova platform ls

    Installed platforms:
      android 10.1.2
    Available platforms: 
      browser ^6.0.0
      electron ^3.0.0
      ios ^6.2.0
      osx ^6.0.0

• Plugins & versions installed in project (including this plugin)
  • cordova plugin ls cordova-plugin-firebasex 14.2.0 "Google Firebase Plugin"
• Dev machine OS and version, e.g.
  • OSX
    • sw_vers

      ProductName:    macOS
      ProductVersion: 12.5
      BuildVersion:   21G72

  • Windows 10
    • winver

Runtime issue

• Device details
  • e.g. iPhone X, Samsung Galaxy S8, iPhone X Simulator, Pixel XL Emulator
• OS details
  • e.g. iOS 12.2, Android 9.0

Android build issue:

• Node JS version
  • node -v
• Gradle version
  • ls platforms/android/.gradle
• Target Android SDK version
  • android:targetSdkVersion in AndroidManifest.xml
• Android SDK details
  • sdkmanager --list | sed -e '/Available Packages/q'

iOS build issue:

• Node JS version
  • node -v
• XCode version

Related code:

insert any relevant code here such as plugin API calls / input parameters

Console output

console output

``` // Paste any relevant JS/native console output here ```

**Other information:**

[dpa99c]

This plugin depends on on the Firebase Auth SDK which implicitly depends on the Safety Net SDK. The currently pinned version of the Firebase Auth SDK is v21.0.4. However if you wish to use a different (newer) version than the pinned version, you can use the ANDROID_FIREBASE_AUTH_VERSION plugin variable to set this version at plugin installation time. The latest version is 21.0.6 so:

cordova plugin add cordova-plugin-firebasex --variable ANDROID_FIREBASE_AUTH_VERSION=21.0.6

Though it looks to me like the latest firebase-auth@21.0.6 still depends on play-services-safetynet@17.0.0 so Google still hasn't updated it to the latest version.

I don't think it's possible to force firebase-auth@21.0.6 to use a higher version of play-services-safetynet so we'll have to wait for Google to release a new version to resolve this. When this happens you can use the plugin variable to update the version. The pinned version will be updated during the next plugin release to npm.

[eun-choi]

Related: https://github.com/firebase/firebase-android-sdk/issues/3890

[alexneats]

Hello -

Firstly, my app is currently using v11.0.3-cli of this plugin; upgrading above 11.0.3-cli isn't an option due to other super old dependencies.

I can see that there is a firebase-auth@21.3.0 out now, but that looks like it's still depending on SafetyNet 17.0.0.

Regarding the link that @eun-choi shared, this is the latest:

We have just released Firebase Auth 21.2.0 (BoM 31.4.0) which adds support for Play Integrity in phone auth. We recommend that you migrate to it as soon as possible (just need to update the version in the Gradle file, no breaking changes in code).

I've seen conflicting info on how to "migrate to it" ahead of the June 2023 deadline:

• The quote above makes it sound like just bumping ANDROID_FIREBASE_AUTH_VERSION to 21.2.0 (or maybe even 21.3.0 now) is all that's needed
• I've seen other documentation mentioning the need to enable the Play Integrity API at the Google Play Console and link it to the associated Firebase project (sharing the SHA-256 fingerprint); this might only be related to app's that are intended to use 'phone authentication' though

As my app doesn't use 'phone authentication', and all it uses the firebasex plugin for is in regard to Cloud Messaging, can anyone confirm if any action is actually needed here for my case?

If so, what specific action needs to be taken?

If action is needed, but is not taken, does anyone know exactly what will happen after the June 2023 deadline?

[alexneats]

I should have mentioned that my app also uses Crashlytics. These are the plugin methods I'm consuming in general:

• onMessageReceived
• onTokenRefresh
• unregister
• setAutoInitEnabled
• grantPermission
• hasPermission
• getToken
• setCrashlyticsUserId

It's sounding more and more like I may not need to worry about doing anything ahead of the upcoming 2023-2024 SafetyNet deprecation deadlines (and that I can continue ignoring the warnings that the Google Play Console displays) since my app isn't utilizing the Authentication suite of features in Firebase at all.

Can anyone confirm?

[RohitGadhave]

cordova plugin add cordova-plugin-firebasex --variable ANDROID_FIREBASE_AUTH_VERSION=22.0.0

try this. this will work.

[codewise-nicolas]

@RohitGadhave Thank you that did the trick for me to get rid of several Google SDK warnings.

[rafaelwake]

Dear, I have this issue in my ionic aplication.

I used this command: cordova plugin add cordova-plugin-firebasex --variable ANDROID_FIREBASE_AUTH_VERSION=22.2.0

My plugin was updated, but when I send the aplication to Google Console, shows a new error: Exception java.lang.NoClassDefFoundError: Failed resolution of: Lcom/google/firebase/appcheck/interop/InternalAppCheckTokenProvider; at com.google.firebase.firestore.FirestoreRegistrar.getComponents (FirestoreRegistrar.java:54) at com.google.firebase.tracing.ComponentMonitor.processRegistrar (ComponentMonitor.java:28) at com.google.firebase.components.ComponentRuntime.discoverComponents (ComponentRuntime.java:118) at com.google.firebase.components.ComponentRuntime. (ComponentRuntime.java:100) at com.google.firebase.components.ComponentRuntime. (ComponentRuntime.java:46) at com.google.firebase.components.ComponentRuntime$Builder.build (ComponentRuntime.java:407) at com.google.firebase.FirebaseApp. (FirebaseApp.java:439) at com.google.firebase.FirebaseApp.initializeApp (FirebaseApp.java:296) at com.google.firebase.FirebaseApp.initializeApp (FirebaseApp.java:264) at com.google.firebase.FirebaseApp.initializeApp (FirebaseApp.java:249) at com.google.firebase.provider.FirebaseInitProvider.onCreate (FirebaseInitProvider.java:69) at android.content.ContentProvider.attachInfo (ContentProvider.java:2451) at android.content.ContentProvider.attachInfo (ContentProvider.java:2421) at com.google.firebase.provider.FirebaseInitProvider.attachInfo (FirebaseInitProvider.java:61) at android.app.ActivityThread.installProvider (ActivityThread.java:7508) at android.app.ActivityThread.installContentProviders (ActivityThread.java:7019) at android.app.ActivityThread.handleBindApplication (ActivityThread.java:6790) at android.app.ActivityThread.-$$Nest$mhandleBindApplication at android.app.ActivityThread$H.handleMessage (ActivityThread.java:2132) at android.os.Handler.dispatchMessage (Handler.java:106) at android.os.Looper.loopOnce (Looper.java:201) at android.os.Looper.loop (Looper.java:288) at android.app.ActivityThread.main (ActivityThread.java:7918) at java.lang.reflect.Method.invoke at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run (RuntimeInit.java:548) at com.android.internal.os.ZygoteInit.main (ZygoteInit.java:936) Caused by java.lang.ClassNotFoundException: com.google.firebase.appcheck.interop.InternalAppCheckTokenProvider

Find information from package.json: "cordova-plugin-firebasex": { "ANDROID_FIREBASE_AUTH_VERSION": "22.2.0", "FIREBASE_ANALYTICS_COLLECTION_ENABLED": "true", "FIREBASE_PERFORMANCE_COLLECTION_ENABLED": "true", "FIREBASE_CRASHLYTICS_COLLECTION_ENABLED": "true", "FIREBASE_FCM_AUTOINIT_ENABLED": "true", "ANDROID_ICON_ACCENT": "#FF00FFFF", "ANDROID_FIREBASE_PERFORMANCE_MONITORING": "false", "ANDROID_PLAY_SERVICES_TAGMANAGER_VERSION": "18.0.2", "ANDROID_PLAY_SERVICES_AUTH_VERSION": "20.4.0", "ANDROID_FIREBASE_ANALYTICS_VERSION": "21.2.0", "ANDROID_FIREBASE_MESSAGING_VERSION": "23.1.0", "ANDROID_FIREBASE_CONFIG_VERSION": "21.2.0", "ANDROID_FIREBASE_PERF_VERSION": "20.3.0", "ANDROID_FIREBASE_INAPPMESSAGING_VERSION": "20.2.0", "ANDROID_FIREBASE_FIRESTORE_VERSION": "24.4.1", "ANDROID_FIREBASE_FUNCTIONS_VERSION": "20.2.1", "ANDROID_FIREBASE_IID_VERSION": "21.1.0", "ANDROID_FIREBASE_INSTALLATIONS_VERSION": "17.1.0", "ANDROID_FIREBASE_CRASHLYTICS_VERSION": "18.3.2", "ANDROID_FIREBASE_CRASHLYTICS_NDK_VERSION": "18.3.2", "ANDROID_GSON_VERSION": "2.9.0", "ANDROID_FIREBASE_PERF_GRADLE_PLUGIN_VERSION": "1.4.2", "ANDROID_GRPC_OKHTTP": "1.46.0" },

Could you please, help-me?

[uchida-nunet]

@RohitGadhave

It works for me. Thanks.

[rafaelwake]

@uchida-nunet Did you have the same problem as me?

@dpa99c , @RohitGadhave could you please, helpe-me?

I used this command: cordova plugin add cordova-plugin-firebasex --variable ANDROID_FIREBASE_AUTH_VERSION=22.2.0

My plugin was updated, but when I send the aplication to Google Console, shows a new error: Exception java.lang.NoClassDefFoundError: Failed resolution of: Lcom/google/firebase/appcheck/interop/InternalAppCheckTokenProvider; at com.google.firebase.firestore.FirestoreRegistrar.getComponents (FirestoreRegistrar.java:54) at com.google.firebase.tracing.ComponentMonitor.processRegistrar (ComponentMonitor.java:28) at com.google.firebase.components.ComponentRuntime.discoverComponents (ComponentRuntime.java:118) at com.google.firebase.components.ComponentRuntime. (ComponentRuntime.java:100) at com.google.firebase.components.ComponentRuntime. (ComponentRuntime.java:46) at com.google.firebase.components.ComponentRuntime$Builder.build (ComponentRuntime.java:407) at com.google.firebase.FirebaseApp. (FirebaseApp.java:439) at com.google.firebase.FirebaseApp.initializeApp (FirebaseApp.java:296) at com.google.firebase.FirebaseApp.initializeApp (FirebaseApp.java:264) at com.google.firebase.FirebaseApp.initializeApp (FirebaseApp.java:249) at com.google.firebase.provider.FirebaseInitProvider.onCreate (FirebaseInitProvider.java:69) at android.content.ContentProvider.attachInfo (ContentProvider.java:2451) at android.content.ContentProvider.attachInfo (ContentProvider.java:2421) at com.google.firebase.provider.FirebaseInitProvider.attachInfo (FirebaseInitProvider.java:61) at android.app.ActivityThread.installProvider (ActivityThread.java:7508) at android.app.ActivityThread.installContentProviders (ActivityThread.java:7019) at android.app.ActivityThread.handleBindApplication (ActivityThread.java:6790) at android.app.ActivityThread.-$$Nest$mhandleBindApplication at android.app.ActivityThread$H.handleMessage (ActivityThread.java:2132) at android.os.Handler.dispatchMessage (Handler.java:106) at android.os.Looper.loopOnce (Looper.java:201) at android.os.Looper.loop (Looper.java:288) at android.app.ActivityThread.main (ActivityThread.java:7918) at java.lang.reflect.Method.invoke at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run (RuntimeInit.java:548) at com.android.internal.os.ZygoteInit.main (ZygoteInit.java:936) Caused by java.lang.ClassNotFoundException: com.google.firebase.appcheck.interop.InternalAppCheckTokenProvider

Find information from package.json: "cordova-plugin-firebasex": { "ANDROID_FIREBASE_AUTH_VERSION": "22.2.0", "FIREBASE_ANALYTICS_COLLECTION_ENABLED": "true", "FIREBASE_PERFORMANCE_COLLECTION_ENABLED": "true", "FIREBASE_CRASHLYTICS_COLLECTION_ENABLED": "true", "FIREBASE_FCM_AUTOINIT_ENABLED": "true", "ANDROID_ICON_ACCENT": "#FF00FFFF", "ANDROID_FIREBASE_PERFORMANCE_MONITORING": "false", "ANDROID_PLAY_SERVICES_TAGMANAGER_VERSION": "18.0.2", "ANDROID_PLAY_SERVICES_AUTH_VERSION": "20.4.0", "ANDROID_FIREBASE_ANALYTICS_VERSION": "21.2.0", "ANDROID_FIREBASE_MESSAGING_VERSION": "23.1.0", "ANDROID_FIREBASE_CONFIG_VERSION": "21.2.0", "ANDROID_FIREBASE_PERF_VERSION": "20.3.0", "ANDROID_FIREBASE_INAPPMESSAGING_VERSION": "20.2.0", "ANDROID_FIREBASE_FIRESTORE_VERSION": "24.4.1", "ANDROID_FIREBASE_FUNCTIONS_VERSION": "20.2.1", "ANDROID_FIREBASE_IID_VERSION": "21.1.0", "ANDROID_FIREBASE_INSTALLATIONS_VERSION": "17.1.0", "ANDROID_FIREBASE_CRASHLYTICS_VERSION": "18.3.2", "ANDROID_FIREBASE_CRASHLYTICS_NDK_VERSION": "18.3.2", "ANDROID_GSON_VERSION": "2.9.0", "ANDROID_FIREBASE_PERF_GRADLE_PLUGIN_VERSION": "1.4.2", "ANDROID_GRPC_OKHTTP": "1.46.0" },

[uchida-nunet]

@rafaelwake

No, it looks like a different problem than I had.