search

firebase / flutterfire

🔥 A collection of Firebase plugins for Flutter apps.
https://firebase.google.com/docs/flutter/setup
BSD 3-Clause "New" or "Revised" License
8.68k stars 3.97k forks source link

Flutter Firestore read/write not working in release when enabling appcheck #10016

Closed safecdev closed 1 year ago

safecdev commented 1 year ago

Bug report

Describe the bug I have a flutter app build in Android. The application is reading/writing data in firestore and uses AppCheck for security. The error occured when doing read/write operation in firestore in Release only. The error is "Permission denied" "The caller does not have permission to execute the specified operation."

I first suspected the security rules BUT with same security rules enabled it works in Debug. I anyway tried allow read,write: if true; but still failed in release. I double checked the signature in the Google Play Console - App Integrity - App Signing and the certificate that I use locally to sign and they are the same. I double checked the certificates in AppCheck console and Google Play Console - App Integrity - App signing to see if they are the same and they are (I put the upload and the app signing ones). I unzipped the appbundle to check the SHA256 and it is the one I have in Google Play Console App Signing and in AppCheck console.

At the end, I deactivate AppCheck and it works right away.

Any help ? I don't see more tests I can do. What could be the issue (certainly my side ;) ) ? Is there some logs I can find on AppCheck checking, available in Release ?

Many many many thanks

Steps to reproduce

The flutter application is initialized as follow:

await Firebase.initializeApp(options: DefaultFirebaseOptions.currentPlatform,); await FirebaseAppCheck.instance.activate(); The version of flutter is 3.3.8 The version of firebase plugins are :

The build.gradle main part is :

android {
    compileSdkVersion 33
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }
    kotlinOptions {
        jvmTarget = "1.8"
    }
    sourceSets {
        main.java.srcDirs += "src/main/kotlin"
    }
    defaultConfig {
        applicationId "com.team.xyz"
        minSdkVersion 21
        targetSdkVersion 33
        versionCode flutterVersionCode.toInteger()
        versionName flutterVersionName
    }
    signingConfigs {
       release {
           keyAlias keystoreProperties["keyAlias"]
           keyPassword keystoreProperties["keyPassword"]
           storeFile keystoreProperties["storeFile"] ? file(keystoreProperties["storeFile"]) : null
           storePassword keystoreProperties["storePassword"]
       }
   }
   buildTypes {
        release {
            signingConfig signingConfigs.release
        }
    }
    aaptOptions {
        noCompress "tflite"  // Your model's file extension: "tflite", "lite", etc.
    }
}
flutter {
    source "../.."
}
configurations.all {
    resolutionStrategy {
        force "com.squareup.okhttp:okhttp:2.7.5"
        force "com.squareup.okio:okio:1.17.5"
    }
}
dependencies {
    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version"
    implementation "com.google.mlkit:playstore-dynamic-feature-support:16.0.0-beta2"
    implementation "com.google.mlkit:text-recognition-chinese:16.0.0-beta5"
    implementation platform("com.google.firebase:firebase-bom:31.0.3")
    implementation "com.google.firebase:firebase-analytics-ktx:21.2.0"
    implementation "com.google.firebase:firebase-appcheck-debug:16.0.2"
}

and 

buildscript {
    ext.kotlin_version = '1.7.21'
    repositories {
        google()
        mavenCentral()
    }
    dependencies {
        classpath "com.android.tools.build:gradle:7.3.0"
        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
        classpath "com.google.gms:google-services:4.3.14"
    }
}

The resolutionStrategy comes from the following thread due to version incompatibility https://github.com/firebase/flutterfire/issues/8501

1 - If I build an app in release mode and put it directly(USB) on a real device, will it work with AppCheck without needs of "Debug Token" to be added manually ? I suppose that because it is using the certificate defined in App signing Google Play Console it should work exactly the same, is it correct ? 2 - Main question is, Does anyone have an idea what could be the problem ? 3 - Is there any logs that can be activated or test being performed to ensure AppCheck is authorized ? Or at least seeing the check of the signatures ? In Google Cloud logs maybe ?

Many thanks

Expected behavior

Firestore calls are authorized with AppCheck enabled.

Sample project

Flutter doctor

Run flutter doctor and paste the output below:

Click To Expand ``` [√] Flutter (Channel stable, 3.3.8, on Microsoft Windows [Version 10.0.22621.819], locale en-US) [√] Android toolchain - develop for Android devices (Android SDK version 31.0.0) [√] Chrome - develop for the web [X] Visual Studio - develop for Windows X Visual Studio not installed; this is necessary for Windows development. Download at https://visualstudio.microsoft.com/downloads/. Please install the "Desktop development with C++" workload, including all of its default components [√] Android Studio (version 2020.3) [√] VS Code (version 1.73.1) [√] Connected device (3 available) [√] HTTP Host Availability ```

Flutter dependencies

Run flutter pub deps -- --style=compact and paste the output below:

Click To Expand ``` Dart SDK 2.18.4 Flutter SDK 3.3.8 myapp 1.0.1+16 dependencies: - camera 0.10.0+4 [camera_android camera_avfoundation camera_platform_interface camera_web flutter flutter_plugin_android_lifecycle quiver] - charts_flutter 0.12.0 [charts_common collection flutter intl logging meta] - cloud_firestore 4.1.0 [cloud_firestore_platform_interface cloud_firestore_web collection firebase_core firebase_core_platform_interface flutter meta] - cloud_functions 4.0.5 [cloud_functions_platform_interface cloud_functions_web firebase_core firebase_core_platform_interface flutter] - collection 1.16.0 - country_code_picker 2.0.2 [flutter modal_bottom_sheet collection universal_platform] - cupertino_icons 1.0.5 - email_validator 2.1.17 - f_logs 2.0.1 [flutter sembast path_provider intl xxtea meta path stack_trace] - fast_qr_reader_view 0.2.0 [flutter] - firebase_analytics 10.0.6 [firebase_analytics_platform_interface firebase_analytics_web firebase_core firebase_core_platform_interface flutter] - firebase_app_check 0.1.1+5 [firebase_app_check_platform_interface firebase_app_check_web firebase_core firebase_core_platform_interface flutter] - firebase_auth 4.1.3 [firebase_auth_platform_interface firebase_auth_web firebase_core firebase_core_platform_interface flutter meta] - firebase_core 2.3.0 [firebase_core_platform_interface firebase_core_web flutter meta] - firebase_crashlytics 3.0.6 [firebase_core firebase_core_platform_interface firebase_crashlytics_platform_interface flutter stack_trace] - firebase_remote_config 3.0.6 [firebase_core firebase_core_platform_interface firebase_remote_config_platform_interface firebase_remote_config_web flutter] - firebase_storage 11.0.6 [firebase_core firebase_core_platform_interface firebase_storage_platform_interface firebase_storage_web flutter] - fl_chart 0.55.2 [flutter equatable] - flag 6.0.0 [flutter flutter_svg enum_to_string] - flutter 0.0.0 [characters collection material_color_utilities meta vector_math sky_engine] - flutter_bloc 8.1.1 [flutter bloc provider] - flutter_email_sender 5.2.0 [flutter] - flutter_localizations 0.0.0 [flutter intl characters clock collection material_color_utilities meta path vector_math] - flutter_typeahead 4.1.1 [flutter flutter_keyboard_visibility] - font_awesome_flutter 10.2.1 [flutter] - geocoding 2.0.5 [flutter geocoding_platform_interface] - google_fonts 3.0.1 [flutter http path_provider crypto] - google_ml_kit 0.13.0 [flutter google_mlkit_barcode_scanning google_mlkit_digital_ink_recognition google_mlkit_face_detection google_mlkit_image_labeling google_mlkit_object_detection google_mlkit_pose_detection google_mlkit_selfie_segmentation google_mlkit_text_recognition google_mlkit_entity_extraction google_mlkit_language_id google_mlkit_translation google_mlkit_smart_reply] - hive 2.2.3 [meta crypto] - hive_flutter 1.1.0 [flutter hive path_provider path] - http 0.13.5 [async http_parser meta path] - image_picker 0.8.6 [flutter image_picker_android image_picker_for_web image_picker_ios image_picker_platform_interface] - in_app_purchase 3.0.8 [flutter in_app_purchase_android in_app_purchase_platform_interface in_app_purchase_storekit] - intl 0.17.0 [clock path] - json_annotation 4.7.0 [meta] - json_serializable 6.5.4 [analyzer async build build_config collection json_annotation meta path pub_semver pubspec_parse source_gen source_helper] - listenable_stream 1.1.0 [rxdart flutter] - location 4.4.0 [flutter location_platform_interface location_web] - open_filex 4.3.1 [flutter ffi] - package_info_plus 3.0.2 [ffi flutter flutter_web_plugins http meta path package_info_plus_platform_interface win32] - pdf 3.8.4 [archive barcode crypto image meta path_parsing vector_math xml] - printing 5.9.3 [ffi flutter flutter_web_plugins http image js meta pdf plugin_platform_interface] - provider 6.0.4 [collection flutter nested] - retry 3.1.0 - rxdart 0.27.7 - shared_preferences 2.0.15 [flutter shared_preferences_android shared_preferences_ios shared_preferences_linux shared_preferences_macos shared_preferences_platform_interface shared_preferences_web shared_preferences_windows] - sqflite 2.2.0+3 [flutter sqflite_common path] - timelines 0.1.0 [flutter] - tutorial_coach_mark 1.2.4 [flutter] - url_launcher 6.1.6 [flutter url_launcher_android url_launcher_ios url_launcher_linux url_launcher_macos url_launcher_platform_interface url_launcher_web url_launcher_windows] - uuid 3.0.7 [crypto] - version 3.0.2 - video_player 2.4.7 [flutter html video_player_android video_player_avfoundation video_player_platform_interface video_player_web] dev dependencies: - build_runner 2.3.0 [args async analyzer build build_config build_daemon build_resolvers build_runner_core code_builder collection crypto dart_style frontend_server_client glob graphs http_multi_server io js logging meta mime package_config path pool pub_semver pubspec_parse shelf shelf_web_socket stack_trace stream_transform timing watcher web_socket_channel yaml] - flutter_launcher_icons 0.11.0 [args checked_yaml cli_util image json_annotation path yaml] - flutter_lints 2.0.1 [lints] - flutter_test 0.0.0 [flutter test_api path fake_async clock stack_trace vector_math async boolean_selector characters collection matcher material_color_utilities meta source_span stream_channel string_scanner term_glyph] - get_it 7.2.0 [async collection] - hive_generator 1.1.3 [build source_gen hive analyzer source_helper] - integration_test 0.0.0 [flutter flutter_driver flutter_test path vm_service archive async boolean_selector characters clock collection crypto fake_async file matcher material_color_utilities meta source_span stack_trace stream_channel string_scanner sync_http term_glyph test_api typed_data vector_math webdriver] - test 1.21.4 [analyzer async boolean_selector collection coverage http_multi_server io js node_preamble package_config path pool shelf shelf_packages_handler shelf_static shelf_web_socket source_span stack_trace stream_channel typed_data web_socket_channel webkit_inspection_protocol yaml test_api test_core] transitive dependencies: - _fe_analyzer_shared 47.0.0 [meta] - _flutterfire_internals 1.0.9 [cloud_firestore_platform_interface cloud_firestore_web collection firebase_core firebase_core_platform_interface flutter meta] - analyzer 4.7.0 [_fe_analyzer_shared collection convert crypto glob meta package_config path pub_semver source_span watcher yaml] - archive 3.3.0 [crypto path] - args 2.3.1 - async 2.9.0 [collection meta] - barcode 2.2.3 [meta qr] - bloc 8.1.0 [meta] - boolean_selector 2.1.0 [source_span string_scanner] - build 2.3.1 [analyzer async convert crypto glob logging meta path] - build_config 1.1.1 [checked_yaml json_annotation path pubspec_parse yaml] - build_daemon 3.1.0 [built_collection built_value http_multi_server logging path pool shelf shelf_web_socket stream_transform watcher web_socket_channel] - build_resolvers 2.0.10 [analyzer async build crypto graphs logging path package_config pool pub_semver stream_transform yaml] - build_runner_core 7.2.7 [async build build_config build_resolvers collection convert crypto glob graphs json_annotation logging meta path package_config pool timing watcher yaml] - built_collection 5.1.1 - built_value 8.4.2 [built_collection collection fixnum meta] - camera_android 0.10.0+4 [camera_platform_interface flutter flutter_plugin_android_lifecycle stream_transform] - camera_avfoundation 0.9.8+6 [camera_platform_interface flutter stream_transform] - camera_platform_interface 2.3.0 [cross_file flutter plugin_platform_interface stream_transform] - camera_web 0.3.0+1 [camera_platform_interface flutter flutter_web_plugins stream_transform] - characters 1.2.1 - charts_common 0.12.0 [collection intl logging meta vector_math] - checked_yaml 2.0.1 [json_annotation source_span yaml] - cli_util 0.3.5 [meta path] - clock 1.1.1 - cloud_firestore_platform_interface 5.9.0 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface] - cloud_firestore_web 3.1.0 [_flutterfire_internals cloud_firestore_platform_interface collection firebase_core firebase_core_web flutter flutter_web_plugins js] - cloud_functions_platform_interface 5.1.24 [firebase_core flutter meta plugin_platform_interface] - cloud_functions_web 4.3.13 [cloud_functions_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins js] - code_builder 4.3.0 [built_collection built_value collection matcher meta] - convert 3.1.1 [typed_data] - coverage 1.5.0 [args logging package_config path source_maps stack_trace vm_service] - cross_file 0.3.3+2 [js meta] - crypto 3.0.2 [typed_data] - csslib 0.17.2 [source_span] - dart_style 2.2.4 [analyzer args path pub_semver source_span] - enum_to_string 2.0.1 - equatable 2.0.5 [collection meta] - fake_async 1.3.1 [clock collection] - ffi 2.0.1 - file 6.1.2 [meta path] - firebase_analytics_platform_interface 3.3.14 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface] - firebase_analytics_web 0.5.1+5 [_flutterfire_internals firebase_analytics_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins js] - firebase_app_check_platform_interface 0.0.5+8 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface] - firebase_app_check_web 0.0.7+8 [_flutterfire_internals firebase_app_check_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins js] - firebase_auth_platform_interface 6.11.3 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface] - firebase_auth_web 5.1.3 [firebase_auth_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins http_parser intl js meta] - firebase_core_platform_interface 4.5.2 [collection flutter flutter_test meta plugin_platform_interface] - firebase_core_web 2.0.1 [firebase_core_platform_interface flutter flutter_web_plugins js meta] - firebase_crashlytics_platform_interface 3.3.7 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface] - firebase_remote_config_platform_interface 1.1.26 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface] - firebase_remote_config_web 1.1.15 [firebase_core firebase_core_web firebase_remote_config_platform_interface flutter flutter_web_plugins js] - firebase_storage_platform_interface 4.1.24 [collection firebase_core flutter meta plugin_platform_interface] - firebase_storage_web 3.3.16 [_flutterfire_internals async firebase_core firebase_core_web firebase_storage_platform_interface flutter flutter_web_plugins http js meta] - fixnum 1.0.1 - flutter_driver 0.0.0 [file flutter flutter_test fuchsia_remote_debug_protocol path meta vm_service webdriver archive async boolean_selector characters clock collection crypto matcher material_color_utilities platform process source_span stack_trace stream_channel string_scanner sync_http term_glyph test_api typed_data vector_math] - flutter_keyboard_visibility 5.4.0 [meta flutter_keyboard_visibility_platform_interface flutter_keyboard_visibility_linux flutter_keyboard_visibility_macos flutter_keyboard_visibility_web flutter_keyboard_visibility_windows flutter] - flutter_keyboard_visibility_linux 1.0.0 [flutter_keyboard_visibility_platform_interface flutter] - flutter_keyboard_visibility_macos 1.0.0 [flutter_keyboard_visibility_platform_interface flutter] - flutter_keyboard_visibility_platform_interface 2.0.0 [flutter meta plugin_platform_interface] - flutter_keyboard_visibility_web 2.0.0 [flutter_keyboard_visibility_platform_interface flutter_web_plugins flutter] - flutter_keyboard_visibility_windows 1.0.0 [flutter_keyboard_visibility_platform_interface flutter] - flutter_plugin_android_lifecycle 2.0.7 [flutter] - flutter_svg 1.1.6 [flutter meta path_drawing vector_math xml] - flutter_web_plugins 0.0.0 [flutter js characters collection material_color_utilities meta vector_math] - frontend_server_client 2.1.3 [async path] - fuchsia_remote_debug_protocol 0.0.0 [process vm_service file meta path platform] - geocoding_platform_interface 2.0.1 [flutter meta plugin_platform_interface] - glob 2.1.0 [async collection file path string_scanner] - google_mlkit_barcode_scanning 0.5.0 [flutter google_mlkit_commons] - google_mlkit_commons 0.2.0 [flutter] - google_mlkit_digital_ink_recognition 0.6.0 [flutter google_mlkit_commons] - google_mlkit_entity_extraction 0.6.0 [flutter google_mlkit_commons] - google_mlkit_face_detection 0.5.0 [flutter google_mlkit_commons] - google_mlkit_image_labeling 0.5.0 [flutter google_mlkit_commons] - google_mlkit_language_id 0.5.0 [flutter google_mlkit_commons] - google_mlkit_object_detection 0.6.0 [flutter google_mlkit_commons] - google_mlkit_pose_detection 0.5.0 [flutter google_mlkit_commons] - google_mlkit_selfie_segmentation 0.2.0 [flutter google_mlkit_commons] - google_mlkit_smart_reply 0.5.0 [flutter google_mlkit_commons] - google_mlkit_text_recognition 0.5.0 [flutter google_mlkit_commons] - google_mlkit_translation 0.5.0 [flutter google_mlkit_commons] - graphs 2.2.0 [collection] - html 0.15.1 [csslib source_span] - http_multi_server 3.2.1 [async] - http_parser 4.0.2 [collection source_span string_scanner typed_data] - image 3.2.2 [archive meta xml] - image_picker_android 0.8.5+3 [flutter flutter_plugin_android_lifecycle image_picker_platform_interface] - image_picker_for_web 2.1.10 [flutter flutter_web_plugins image_picker_platform_interface] - image_picker_ios 0.8.6+1 [flutter image_picker_platform_interface] - image_picker_platform_interface 2.6.2 [cross_file flutter http plugin_platform_interface] - in_app_purchase_android 0.2.3+6 [collection flutter in_app_purchase_platform_interface json_annotation] - in_app_purchase_platform_interface 1.3.2 [flutter plugin_platform_interface] - in_app_purchase_storekit 0.3.3 [collection flutter in_app_purchase_platform_interface json_annotation] - io 1.0.3 [meta path string_scanner] - js 0.6.4 - lints 2.0.1 - location_platform_interface 2.3.0 [flutter meta plugin_platform_interface] - location_web 3.1.1 [flutter flutter_web_plugins http_parser js location_platform_interface meta] - logging 1.1.0 - matcher 0.12.12 [stack_trace] - material_color_utilities 0.1.5 - meta 1.8.0 - mime 1.0.2 - modal_bottom_sheet 2.1.2 [flutter] - nested 1.0.0 [flutter] - node_preamble 2.0.1 - package_config 2.1.0 [path] - package_info_plus_platform_interface 2.0.1 [flutter meta plugin_platform_interface] - path 1.8.2 - path_drawing 1.0.1 [vector_math meta path_parsing flutter] - path_parsing 1.0.1 [vector_math meta] - path_provider 2.0.11 [flutter path_provider_android path_provider_ios path_provider_linux path_provider_macos path_provider_platform_interface path_provider_windows] - path_provider_android 2.0.21 [flutter path_provider_platform_interface] - path_provider_ios 2.0.11 [flutter path_provider_platform_interface] - path_provider_linux 2.1.7 [ffi flutter path path_provider_platform_interface xdg_directories] - path_provider_macos 2.0.6 [flutter path_provider_platform_interface] - path_provider_platform_interface 2.0.5 [flutter platform plugin_platform_interface] - path_provider_windows 2.1.3 [ffi flutter path path_provider_platform_interface win32] - petitparser 5.1.0 [meta] - platform 3.1.0 - plugin_platform_interface 2.1.3 [meta] - pool 1.5.1 [async stack_trace] - process 4.2.4 [file path platform] - pub_semver 2.1.3 [collection meta] - pubspec_parse 1.2.1 [checked_yaml collection json_annotation pub_semver yaml] - qr 3.0.1 [meta] - quiver 3.1.0 [matcher] - sembast 3.3.1 [meta path synchronized] - shared_preferences_android 2.0.14 [flutter shared_preferences_platform_interface] - shared_preferences_ios 2.1.1 [flutter shared_preferences_platform_interface] - shared_preferences_linux 2.1.1 [file flutter path path_provider_linux path_provider_platform_interface shared_preferences_platform_interface] - shared_preferences_macos 2.0.4 [flutter shared_preferences_platform_interface] - shared_preferences_platform_interface 2.1.0 [flutter plugin_platform_interface] - shared_preferences_web 2.0.4 [flutter flutter_web_plugins shared_preferences_platform_interface] - shared_preferences_windows 2.1.1 [file flutter path path_provider_platform_interface path_provider_windows shared_preferences_platform_interface] - shelf 1.4.0 [async collection http_parser path stack_trace stream_channel] - shelf_packages_handler 3.0.1 [path shelf shelf_static] - shelf_static 1.1.1 [convert http_parser mime path shelf] - shelf_web_socket 1.0.3 [shelf stream_channel web_socket_channel] - sky_engine 0.0.99 - source_gen 1.2.6 [analyzer async build dart_style glob meta path source_span yaml] - source_helper 1.3.3 [analyzer collection source_gen] - source_map_stack_trace 2.1.1 [path source_maps stack_trace] - source_maps 0.10.11 [source_span] - source_span 1.9.0 [collection path term_glyph] - sqflite_common 2.4.0+2 [synchronized path meta] - stack_trace 1.10.0 [path] - stream_channel 2.1.0 [async] - stream_transform 2.1.0 - string_scanner 1.1.1 [source_span] - sync_http 0.3.1 - synchronized 3.0.0+3 - term_glyph 1.2.1 - test_api 0.4.12 [async boolean_selector collection meta source_span stack_trace stream_channel string_scanner term_glyph matcher] - test_core 0.4.16 [analyzer async args boolean_selector collection coverage frontend_server_client glob io meta package_config path pool source_map_stack_trace source_maps source_span stack_trace stream_channel vm_service yaml matcher test_api] - timing 1.0.0 [json_annotation] - typed_data 1.3.1 [collection] - universal_platform 1.0.0+1 - url_launcher_android 6.0.21 [flutter url_launcher_platform_interface] - url_launcher_ios 6.0.17 [flutter url_launcher_platform_interface] - url_launcher_linux 3.0.1 [flutter url_launcher_platform_interface] - url_launcher_macos 3.0.1 [flutter url_launcher_platform_interface] - url_launcher_platform_interface 2.1.1 [flutter plugin_platform_interface] - url_launcher_web 2.0.13 [flutter flutter_web_plugins url_launcher_platform_interface] - url_launcher_windows 3.0.1 [flutter url_launcher_platform_interface] - vector_math 2.1.2 - video_player_android 2.3.9 [flutter video_player_platform_interface] - video_player_avfoundation 2.3.7 [flutter video_player_platform_interface] - video_player_platform_interface 5.1.4 [flutter plugin_platform_interface] - video_player_web 2.0.12 [flutter flutter_web_plugins video_player_platform_interface] - vm_service 9.0.0 - watcher 1.0.2 [async path] - web_socket_channel 2.2.0 [async crypto stream_channel] - webdriver 3.0.0 [archive matcher path stack_trace sync_http] - webkit_inspection_protocol 1.2.0 [logging] - win32 3.1.1 [ffi] - xdg_directories 0.2.0+2 [meta path process] - xml 6.1.0 [collection meta petitparser] - xxtea 2.1.0 - yaml 3.1.1 [collection source_span string_scanner] ```
darshankawar commented 1 year ago

Thanks for the report @safecdev You can probably try to check if it is security issue or not by calling your document / collection something like below:

collection('foo').doc('bar').get().then(console.log).catch(console.log). See if it returns any log that will be useful to debug further. Note: You might need to tweak above a bit to run on Android, ie, on mobile platform as applicable.

dvagala commented 1 year ago

@safecdev Hey was experiencing a similar issue, the same error in the production app, but eventually, I found out that I just forgot to enable Integrity API on Google console.

But I have few questions:

safecdev commented 1 year ago

Hi,

Thank you for your response. And sorry for delay my side.

I upgraded to the latest version of flutter plugins meaning that the default provider is now: AndroidProvider androidProvider = AndroidProvider.playIntegrity I looked the doc and PlayIntegrity requires the API Integration access needs to be configured, Feels like config problem, I am trying that and keep you inform.

I still have one thing I don't see if it is possible or not:

Thank you

darshankawar commented 1 year ago
  • I have a real device with developer active
  • I put RELEASE version of my app (version signed with the exact same certificate as the one defined in the App Signing in Google Play Console)
  • I put the SHA256 of the previous certificate in the AppCheck Console

  • When I run this app, will the AppCheck be trusting my App ? Without having to publish it first using the App Bundle explorer ?

    • If not... why ?

I think this question / use case is better to be asked in native firebase repo or in firebase support, because flutterfire plugins are wrappers around respective firebase sdks.

djsjr commented 1 year ago

@safecdev Hey was experiencing a similar issue, the same error in the production app, but eventually, I found out that I just forgot to enable Integrity API on Google console.

But I have few questions:

  • Are you using Play Integrity or deprecated SafetyNet?
  • If Play Integrity, how did you managed to run the app locally, when it supports only the Google Play distributed apps? Did you use debug tokens, or did you implement your own custom App Check provider?

Also needed to enable Integrity API. Flutter App Check docs should include this step in the docs.

safecdev commented 1 year ago

Hi,

Activating Integrity API does the work.

Thank you

On Fri, Dec 9, 2022 at 5:49 AM djsjr @.***> wrote:

@safecdev https://github.com/safecdev Hey was experiencing a similar issue, the same error in the production app, but eventually, I found out that I just forgot to enable Integrity API on Google console.

But I have few questions:

  • Are you using Play Integrity or deprecated SafetyNet?
  • If Play Integrity, how did you managed to run the app locally, when it supports only the Google Play distributed apps? Did you use debug tokens, or did you implement your own custom App Check provider?

Also needed to enable Integrity API. Flutter App Check docs should include this step in the docs.

— Reply to this email directly, view it on GitHub https://github.com/firebase/flutterfire/issues/10016#issuecomment-1343844915, or unsubscribe https://github.com/notifications/unsubscribe-auth/AXT4B7M6ZYTODAGXC3DHQKTWMK25RANCNFSM6AAAAAASON2F3Q . You are receiving this because you were mentioned.Message ID: @.***>

darshankawar commented 1 year ago

Closing this as resolved based on above comment.