feat(appcheck): Verify one-time tokens for replay protection - #774
feat(appcheck): Verify one-time tokens for replay protection#774yvonnep165 wants to merge 18 commits into
Conversation
yvonnep165
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the VerifyOneTimeToken method to the App Check client, enabling stateful verification and consumption of one-time tokens. It also adds the AlreadyConsumed field to DecodedAppCheckToken and integrates HTTP client options. Feedback on the tests suggests using a helper function to instantiate *bool pointers to reduce verbosity, and restoring the mutated global verifyURLFormat variable to prevent potential race conditions and side effects.
weixifan
left a comment
weixifan
left a comment
There was a problem hiding this comment.
Thank you for the PR; LGTM with just a minor comment.
| const appCheckIssuer = "https://firebaseappcheck.googleapis.com/" | ||
|
|
||
| var ( | ||
| verifyURLFormat = "https://firebaseappcheck.googleapis.com/v1beta/projects/%s:verifyAppCheckToken" |
There was a problem hiding this comment.
Our v1 endpoint is almost ready, and that would be our preferred URL when this SDK is released. Maybe we can just change this to v1 now?
I'm also fine with leaving this alone for now and wait until our v1 endpoint is fully published. In that case, is a TODO appropriate here?
There was a problem hiding this comment.
Thanks for the quick review! Sure, we can switch to the v1 endpoint as long as we can verify and run our tests against it. Currently, we only have unit tests in place so we can just change to v1 now, but we plan to add integration tests against the live endpoint once we implement the token creation methods.
There was a problem hiding this comment.
One thing we should keep in mind if we do merge this as v1, is that our next release will include this whether or not the backend is ready. Lets set v1 but hold back merging until the backend is live.
jonathanedey
left a comment
jonathanedey
left a comment
There was a problem hiding this comment.
LGTM with one note on v1 endpoint. Thanks!
5 participants
This PR introduces the
VerifyOneTimeTokenmethod to theappcheckpackage, enabling stateful replay protection for Firebase App Check.VerifyOneTimeTokenthat first performs local, stateless JWT verification followed by a statefulPOSTrequest to backend endpoint to consume the token.AlreadyConsumed(*bool) field to theDecodedAppCheckTokenstruct.option.ClientOptionfrom the main app initialization down tointernal.AppCheckConfig.