(upbeat music)
- Hello, everyone.
My name is Tyler, and I’m a product manager at Firebase.
I focus on security and developer tools. And with me today is Rosalyn.
- Hello, I’m Rosalyn, and I’m an engineer at Firebase
with a focus on end user and developer security.
- As we all know, security is hard.
Today, as more threats are discovered,
protecting your users, their data, and access to your resources
grows increasingly important.
Currently you can use Firebase authentication in combination with Firebase security rules
to protect your users and their data.
Firebase authentication allows you to determine
that a user of your app is who they say they are,
while Firebase security rules allows you to gate access to data
based on who is trying to access it.
But what about access to your resources?
It’s also important to make sure that only your trusted applications
are able to use your back-end resources.
That's why we'd like to introduce Firebase App Check,
a new platform to enhance app and resource security.
- Let’s dig in a little deeper to better understand how Firebase App Check can help.
Meet Taylor. She’s an Android developer.
Taylor is building an application for users to upload and store media content.
Taylor develops with security in mind.
In order to make sure that users can only access their own content,
or content their friends have shared with them,
Taylor has integrated her back end with Firebase authentication.
After launching her app on the Play Store, she saw a steady growth and usage.
A great success!
One day, Taylor noticed a large spike in traffic to her back end,
which didn’t seem to fit usage patterns.
After some investigation,
Taylor found the traffic didn’t seem to be coming from her app.
Someone stole her app credentials and was using them to directly access her back end.
- Wow, Roslyn.
That seems like a developer’s worst nightmare.
What can Taylor do?
- So there’s a few things that Taylor could do in her situation.
One example would be to rotate her security credentials
so that the attacker no longer has access to her back end.
She could also try adding restrictions to her API key.
However, both of those approaches still have limitations.
A better solution would be for Taylor to reject traffic
that is not verified to be coming from her Android application.
- That seems like a perfect use case
Taylor can use App Check to easily add this protection
straight into her application.
-It’s pretty awesome there’s an easy solution that Taylor can use to protect her server.
But what exactly is App Check and how does it work?
- Great question, Rosalyn.
App Check is a new platform that protects access
to your services by verifying that traffic is coming from your app.
App Check achieves this security by doing two key things:
app attestation and controlling resource access.
App attestation is the process of verifying
that it is your app running on a device out in the wild
using attestation providers.
The attestation providers attest that it really is your app out there.
Resource access is controlled
by ensuring that traffic includes credentials from App Check,
proving that the request is coming from your app.
So let's see how these flows work to protect your resources.
Your app, running on a user’s device out in the world, boots up.
Your app contacts the attestation provider
that you configured to attest that it is your app.
Once attested, your app exchange is the attestation
for an App Check token.
When your app accesses your resources, say a database,
your app will now pass along the App Check token with the request.
The App Check token is verified by the App Check service,
enabling access to your resource.
Now that we've seen the flows,
what attestation providers are supported on App Check?
On Android, App Check is integrated with SafetyNet.
When your app calls SafetyNet,
it provides a cryptographically signed attestation,
assessing the devices integrity. SafetyNet can be used to help determine
whether your services are interacting with your genuine app,
running on a genuine Android device.
For web, you can use reCAPTCHA to help attest
that requests are coming from your hosted domain
and are not from a bot.
On iOS, App Check is being integrated with App Attest and Device Check .
App Attest gives your app a way to assert that requests sent to your services
come from legitimate instances of your app.
Be on the lookout, as these will become available soon.
We also offer a custom attestation integration,
where you can integrate your own app attestation provider.
This will be helpful if you want to cover other platforms, like IOT or desktop.
Now that we know about providers, let's look at an example.
You’ve written an Android app that uses Cloud Storage for Firebase.
Normally, your app connects to storage
and accesses the necessary data to serve your users.
But how do you know that it is only your app accessing storage?
You’ve registered your app with App Check and enforced the protections with storage.
The App Check process starts with SafetyNet attesting to your app.
Once your app passes the SafetyNet challenge, it is issued an attestation artifact.
The artifact is exchanged for an App Check token
that your app will use to access storage.
As your app sends a request in, the storage API verifies
that there is an authentic App Check token present.
Since you set up enforcement mode,
all requests to the API need to have the App Check token.
You'll even find metrics in the console to monitor your traffic to your end point
so you can see the accepted and denied traffic, letting you rest easy
knowing that all client traffic is coming from your app.
- Thanks for the detailed explanation, Tyler, but how do you set up App Check?
Let's walk through an example of using Firebase App Check
with Cloud Storage for Firebase in an Android application.
There are two main steps when you’re configuring Firebase App Check:
app registration and enforcement.
App registration involves registering your app
and installing the client SDK.
In the Firebase console, you register your app in App Check
with the attestation provider of your choice.
Once you integrate the client SDK into your application code,
your app will start obtaining and sending App Check tokens and requests
to Firebase services.
Requests with missing or invalid App Check tokens
will still go through to the services,
but you’ll start seeing metrics in the App Check settings page
that can inform your decision of whether or not to enforce App Check for a product.
Turning on App Check enforcement for a Firebase product
means that requests that don’t have a valid App Check token attached
will be rejected.
Once you turn on enforcement for App Check,
you will have fully enabled App Check protection for that product.
Now let's see how to register an application
in the Firebase console to use App Check.
You can find the new App Check settings page as a tab under your project settings.
Here, in the overview panel,
you can see all the apps you have in your Firebase project,
as well as their App Check registration status.
To register your app to use App Check, you need to input some information
in order to correctly configure the attestation providers for each platform.
For Android, you’ll need to enter your SHA256 certificate,
as well as enable the Android device verification API
in the cloud console.
For iOS and web, you’ll configure device check or reCAPTCHA.
After you’ve configured your app in the Firebase console,
it's time to integrate App Check into your application code.
Client setup on all three platforms is super simple.
For Android, just get a Firebase App Check instance
and install a SafetyNet App Check provider factory.
For Web, you'll get an App Check instance and then call activate to configure it
with your reCAPTCHA site key.
For iOS, if you’re using device check,
all you need to do is include the Firebase App Check SDK
and everything should be automatically configured.
Now let’s go to Android studio,
and add the code shown from before into my Android app.
Let’s build and run the app now, and then try making a request.
Awesome. There’s not much happening visibly,
but App Check tokens are now being included in my request to storage.
Once you’ve completed your client integration,
you can monitor App Check traffic in the Firebase console.
Let's take a look at a Firebase project that has had App Check previously configured.
Here, you can see the percentage of traffic
to your project’s cloud storage that is verified,
versus traffic that is likely from an outdated client,
versus traffic from an unknown origin, versus malicious traffic.
These are metrics to carefully consider before turning on enforcement for a product.
Let's take a deeper dive through each category.
Verified requests are those that have a valid App Check token attached.
These are requests that have been attested to come from your trusted applications.
Once enforcement is turned on,
these are the only requests that will be allowed through.
Next, we have unverified, likely outdated requests.
These requests are probably coming from your applications,
but from older versions of your app without App Check client integration.
These requests don't have any App Check token attached,
but based on other signals, we determined that this is most likely
just because the request is coming from an old client.
- In my project, it looks like 40% of my requests are in this category.
This probably means I don’t want to turn on enforcement yet, right?
- Probably not yet.
Of course, it's up to you to make that final decision
but turning on enforcement now will mean almost half of your users
will have a broken experience on your app. - That’s good to know.
I should encourage my users to upgrade to the latest version of my app,
so more requests are showing up as verified before turning on enforcement.
- Exactly.
The next category of requests is unverified, unknown origin.
These are requests that don’t have any App Check token attached,
and we also can't make an educated guess as to where this traffic is coming from.
This traffic is most likely not coming from your applications.
The last category is unverified malicious requests.
These requests have an invalid App Check token attached,
meaning that they are also coming from outside your trusted applications.
- Yikes!
If you have a large percentage of requests coming from these last two categories,
then turning on App Check enforcement can help stop this traffic.
- That’s correct.
Once you happy with the percentage of traffic that shows is verified
you can turn on enforcement for a product. Be careful, though.
As a reminder, once you turn on enforcement,
all traffic that is not in the verified category will be rejected.
You’ll want to make sure enough of your requests
are not coming from the likely outdated category
before enforcing App Check for a product to avoid breaking your users.
Let’s go to the project for my Android application now
and turn on enforcement for storage.
Now that App Check is being enforced,
let's try sending a request from the command line.
As you can see, this request is now being rejected.
However, if I make this request from a real device,
it goes through successfully.
- Wow. That’s awesome.
So what happens if I’m developing a new app?
When should I enforce App Check?
- Since you won’t have any outdated clients,
we recommend enforcing at the beginning of development.
-Ah, so I never have to worry about migrating if I’m protecting from the start.
But what if I want to develop using an emulator?
- Great question.
On Android, for example, emulators won’t pass SafetyNet attestation,
which poses a problem for developing on emulators with App Check enforced.
This is why we also provide a debug App Check provider
for all three platforms,
to be used in emulated or simulated environments.
Instead of attesting to application integrity,
the debug App Check provider exchanges a debug secret,
which can be configured in a Firebase console for an App Check token.
- It’s awesome to see App Check at work.
We'd love for you to start integrating your apps today.
App Check is available for Android, iOS, and Web apps
and is integrated with Cloud Storage for Firebase,
real-time database, and cloud functions for Firebase,
with more app attestation providers and product integrations on the way.
Migrate your existing apps to App Check.
If you’re planning on launching an app to production,
integrate with App Check sooner rather than later.
This will save you the headache of migrating old clients in the future.
Check out the guides in our Firebase docs and happy developing.
(upbeat music)