These two concepts work together to help secure your app. Resources and custom backends by requiring API calls to contain a valid FirebaseĪpp Check token. Users, whereas App Check provides attestation of app or device authenticity, Firebase Authentication provides user authentication, which protects your How is App Check related to Firebase Authentication?Īpp Check and Firebase Authentication are complementary parts of your app security Taking an important step towards abuse protection for your backend resources. The elimination of all abuse, but by integrating with App Check, you are It prevents some, but not all, abuse vectorsĭirected towards your backends. How strong is the security provided by App Check?Īpp Check relies on the strength of its attestation providers to determineĪpp or device authenticity. The App Check client SDK caches the token in your app, ready to be sentĪlong with any requests your app makes to protected services.Ī service protected by App Check only accepts requests accompaniedīy a current, valid App Check token.Token might retain some information about the attestation material it Returns to your app an App Check token with an expiration time. Validity of the attestation using parameters registered with the app, and The attestation is sent to the App Check server, which verifies the.Of the app or device's authenticity (or both, depending on the provider). Your app interacts with the provider of your choice to obtain an attestation.In your app, the following happens periodically:
When you enable App Check for a service and include the client SDK You can also use App Check to protect your non-Firebase backend resources. Service that uses either a third-party attestation provider or your ownĪpp Check currently works with the following Firebase products: Supported Firebase productsĪuthentication (beta requires upgrade to Firebase Authentication with Identity Platform) If these are insufficient for your needs, you can also implement your own Originating from an app or platform you haven't authorized.Īpp Check has built-in support for using the following services as When you enable App Check enforcement, requests fromĬlients without a valid attestation will be rejected, as will any request This attestation is attached to every request your app makes to the APIs you Requests originate from an authentic, untampered device.Requests originate from your authentic app.With App Check, devices running your app will use an app or deviceĪttestation provider that attests to one or both of the following: It works withīoth Firebase services, Google Cloud services, and your Unauthorized clients from accessing your backend resources. App Check helps protect your API resources from abuse by preventing
0 kommentar(er)
