NOT using reCAPTCHA for App Check while in development | Angular Community | Page 1

strong plaza Sep 10, 2024, 11:05 AM

#

I have configured my app to use Firebase's App Check, and this requires me to enter the debug token (logged in the browser's console) in my Firebase account each time I start working on my app - even when I use emulators. I wanted to avoid this situation, and thought of skipping reCAPTCHA while the app is running on dev mode by introducing dummy custom provider.

let firebaseApp: FirebaseApp;
export const appConfig = {
  providers: [
    provideFirebaseApp(() => {
      firebaseApp = initializeApp(environment.firebase);
      return firebaseApp;
    }),
    provideAppCheck(() =>
      initializeAppCheck(firebaseApp, {
        provider: isDevMode()
          ? new CustomProvider({
              getToken: async () => ({
                token: Math.random().toString(),
                expireTimeMillis: Date.now() + 86400e3,
              }),
            })
          : new ReCaptchaEnterpriseProvider(environment.recaptcha.siteKey),
        isTokenAutoRefreshEnabled: true,
      })
    ),
    provideAuth(() => {
      const auth = getAuth();
      if (isDevMode()) {
        connectAuthEmulator(auth, 'http://127.0.0.1:9099', {
          disableWarnings: true,
        });
      }
      return auth;
    }),
    // other providers
  ],
} satisfies ApplicationConfig;

However, it's still logging the debug token in the console (not a big deal) and, most importantly, throwing appCheck/fetch-status-error error when calling Firebase APIs (I encountered this error on authentication).
Can anyone help me out on this? I'm lost at this point.
Thanks in advance.

fringe sapphire Sep 10, 2024, 11:08 AM

#

I'm not really aware of how app check works, but have you tried not providing app check at all when in dev mode?

strong plaza Sep 10, 2024, 11:14 AM

#

fringe sapphire I'm not really aware of how app check works, but have you tried not providing ap...

App Check works by attesting that only YOUR app can communicate with YOUR Firebase account (since your Firebase credentials are visible by anyone). And it does that using reCAPTCHA. It's very important that you enable App Check and register your app(s) so that your Firebase creds are useless to others.
I've thought about it and didn't find a way to do it in DRY method. Any idea?

#NOT using reCAPTCHA for App Check while in development