Hello, everyone.
My name is Tyler Crowe, a Product Manager at Firebase
who focuses on security.
Hi everyone.
I’m Ann Zimmer, a Software Developer at Firebase
working on improving developer authentication experiences.
We know that security is an important foundation for your apps.
How to properly protect your users and your resources is a challenge
that we’ve all faced at one time.
That’s why we build our tools with ingrained privacy and security features
so you don’t have to worry.
At Firebase, you can use Firebase Auth
and Security Rules to protect access to user data.
The addition of App Check can be used to mitigate fraud
and secure access to your backend resources.
Working together, these solutions provide stronger security.
So what is App Check?
App Check is a new service in Firebase that was introduced earlier this year.
It’s another way to protect your app by helping ensure your backend resources.
How exactly does it work?
App Check attests that incoming traffic is from your apps
on authentic, untampered devices or from your hosted domains.
Whether you’re building the next hit app in your garage
or running an enterprise app, App Check is always a good idea
to protect your backend resources.
Often access to your backend resources comes at a cost,
and controlling spending when running your app
is an important part of your business.
App Check helps prevent outside actors from accessing your resources.
This ensures that you pay for traffic coming from your app
and not from other sources.
Today, we’re happy to announce that we’ve enhanced App Check
by integrating with more attestation providers.
At launch we supported SafetyNet for Android Device Check for iOS,
reCAPTCHA V3 for the Web, and Custom Attestation for all other platforms.
Today, we’re launching App Attest for iOS
and reCAPTCHA Enterprise for Web for your apps.
We’re also happy to announce additions to the services
you can protect with App Check.
At our launch, earlier this year, we supported Realtime Database,
Cloud Storage for Firebase, and Cloud Functions for Firebase.
After launch, you asked for more support and resources, and we listened.
Firestore can now be protected by App Check.
App Check’s new capabilities don't stop at Firebase Resources.
You can now protect more types of resources, such as your own backend resources
or other resources protected by API management systems like Apigee.
You can even add App Check to the edge of your CDN
to ensure access while enabling quick downloads.
Now, let’s look at setting up App Check with the new attestation providers.
Using App Check in combination with a secured resource such as Firestore,
you can help ensure that only your attested apps
are able to access your resources.
In Firestore, for example, this helps ensure that the data in your database remains valid.
By combining App Check with Firebase Authentication,
where you can validate your users,
you can now confirm the data is coming and going from your user, your app,
and an attested device or your hosted domain.
So Ann, what does this look like in practice?
Let me show you how simple it is to set up the new attestation providers and App Check.
We’ll start with our iOS app.
In the Firebase console under the App Check tab,
you’ll be able to configure the new App Attest provider for your iOS app.
Before you begin, ensure you go to the Apple Developer console
and enable the App Attest API.
Here, I’ll need to add the Team ID.
If I’d already enabled Device Check, this would have been pre-populated for me.
For now, we use the default token time to live, or TTL.
Now, a common question that we hear is,
should I keep both Device Check and App Attest enabled?
We recommend all developers integrate with App Attest
since it is the most advanced app attestation provider for iOS.
App Attest is only available on iOS 14 and above,
so your end users who are on iOS versions 13 and below
will fail the attestation challenge.
Device Check works on iOS 11 and above, so enabling it will ensure your users
on iOS devices running old versions will continue to have access to your app.
If you’re interested in supporting iOS versions below iOS 11,
we recommend that you consider falling back to your own custom attestation.
Back to you, Ann.
Thanks, Tyler.
Given that explanation,
I’ll enable Device Check by uploading my private key file
and adding my key ID from the Apple Developer Center,
so my app uses both attestation providers.
Next, we’ll update the provider for my web app.
Here, you’ll notice that configuring reCAPTCHA Enterprise
is very similar to reCAPTCHA V3.
You'll simply need to provide your site key
and optionally tune the token’s TTL for your app.
Please note that reCAPTCHA Enterprise is a paid service over a certain quota
and is recommended for larger customers, as it has no quota restrictions,
an SLA, and an enterprise support team.
You’ll typically only use one of the two reCAPTCHA solutions.
We've set up our new attestation providers, but we’ve just used the default TTLs.
Tyler, can you give us more details on when to customize our TTL?
When your app goes through the attestation process
with one of the providers, it exchanges the attestation result with App Check
for a token that can be used for access to your services.
The App Check server issues that token with a set time to live, TTL.
When that token exceeds the TTL,
a resource protected by App Check will no longer accept requests
from that app on that device.
To ensure that the app has continued access to its backend resources,
the App Check SDK will automatically refresh the App Check token
by doing the attestation flow again in the background at half of the token’s TTL.
This happens seamlessly in the background to prevent any interruption to your end users.
If a user returns to an app after the TTL has expired,
they will experience some startup latency while the app performs the attestation flow.
The custom TTL allows you to configure how long an App Check token
stays valid on your clients.
The longer the TTL, the lower likelihood that the returning user
will experience app startup latency.
Shorter TTLs provide stronger security because it reduces the window for replays
if a token is leaked or intercepted.
For example, apps such as games might want to require attestation
to be completed more frequently before accessing any resources.
This can prevent fraud and cheating.
In other cases, such as an e-commerce app, the TTL can be turned up
so the attestation flow happens in the background,
so returning users can get back to shopping without any delays.
Shorter TTLs and frequent reattestatation
depletes the quota of the underlying provider faster.
We think the default TTL of one hour will work for most apps,
but feel free to tune as you see fit.
With our attestation providers registered and custom TTLs selected,
we would move on to enforcing Firestore.
Enforcing protections with Firestore works the same way as storage in Realtime Database.
Check out the launch video to see what to think about
when enforcing protections on your Firebase resources.
We’ve heard from our developers with custom backends
that they want to protect their resources, too.
So now we’ve added the ability to protect non-Firebased resources with App Check.
Using the enhanced Node.js admin SDK,
app developers can now verify App Check tokens in their own backend.
This means you only have to integrate one verification into your backend,
and it works easily with apps that use Firebase client SDKs.
So, Ann, what does this look like?
With the App Check SDK,
the app gets an App Check token and sends a token along
as part of the request to their backend service.
In the backend, the token is extracted from the request
and validated using the updated admin SDK.
Once validation is successful,
the backend continues executing the requested action,
having confirmed that the incoming request has been attested to be from your app
associated with your Firebase project.
Let’s look at the code.
Adding the validation to the backend code is a simple process
requiring the addition and initialization of the Node.js admin SDK.
Next, to validate an incoming request,
extract the App Check token from the request header.
If the token isn't present, you’ll instantly fail as unauthorized.
After confirming the token exist,
we’ll send the token to the verifyToken() method for validation.
This method will perform several steps,
including validating the token was issued by Firebase, is not expired,
and that it was obtained by an app in your project.
The successful validation of this token indicates that this is either your app
running on a tested mobile device or your app on your hosted domain,
so the request processing should continue.
If validation fails, terminate the request is unauthorized.
That's not so hard.
But how do we get that token to my backend?
In all cases, we start by adding App Check to your app.
As shown in this Android example,
this can be accomplished in a few simple lines.
To generate the token, let’s start by continuing our Android example.
Before making a request to your protected backend service,
you’ll trigger that generation of an App Check token
using the getAppCheckToken method.
When the method returns successfully, simply extract the token and send it along,
so the token is associated with the Firebase-AppCheck header
in the outgoing request.
The iOS and Web solutions are, as expected, fairly similar.
In the iOS example,
you call the App Check token method to generate the token.
The token is then extracted into a tokenString
and added to the outgoing request as the Firebase-AppCheck header.
Finally, to send the token as part of a web request,
start by initializing App Check
before sending a request to your backend service,
called the getToken method.
When a successful token is returned, simply add it to the outgoing request
associated with the Firebase-AppCheck header.
I’ll show you how this custom solution can integrate
with API management platforms such as Apigee.
An integrated solution offers a complete in-line job verification at the endpoint
without having to do custom verification within your backend.
Wait a minute; Apigee is probably new to some of our developers.
Can you tell them more?
Apigee is an API management platform for developing and managing APIs.
By fronting services with a proxy layer, Apigee provides an abstraction
or facade for your backend service APIs and provides security, rate limiting,
quotas, analytics, and more.
In our case, we care about security.
By combining App Check with Apigee, you can add an extra layer of protection
to help ensure only your apps are allowed to access your resources.
Inside your Apigee UI,
you can add a new API security proxy to complete this verification.
Either start a new proxy or open your existing proxy.
Because App Check tokens are JSON web tokens, or JWTs,
we’ll start by adding a new Verify JWT security policy.
Next, we update the default settings to work with App Check.
We’ll update the display name and change the algorithm to RS256.
As we just saw, the source for the token is found
in the request Firebase-AppCheck header.
The relevant public keys should be set to the JWT’s Firebase URL.
The subject will be your app ID, as found in the Firebase console.
The issuer will be your Firebase App Check API URL
along with your project number.
Finally, set the audience to be your project number.
In our Apigee project, we added protection to our app
to only allow requests from trusted apps.
Before we launch our policy, let’s send this curl command
triggering an API request to our backend.
It succeeds!
Now we add this policy to the proxy endpoint’s preflow
and redeploy the proxy.
This time, when we send the command, it’s unauthorized.
The same call from within our app remains successful.
Today, we’ve seen App Check in action with Firestore, custom backends, and Apigee.
App Check enables you to protect your backend resources
by helping validate that incoming requests
are coming from your authentic app on attested devices and domains.
Gets started today by registering your apps with App Check.
For new apps, start with App Check enforced from the beginning
and help protect all of your traffic.
Migrate your existing apps and turn on enforcement when you’re ready.
The Firebase team is excited to continue delivering more enhancements
to protect your resources.
Let us know how App Check works for you
and how we can continue enhancing your security.