[MUSIC PLAYING]
ALEX VOLKOVITSKY: Hi, folks.
I'm Alex, one of the tech leads at Firebase
working on security.
Today, I'm going to share some new Firebase
features that can help enhance the security of your apps.
Let's take a look.
Have you ever wondered if someone could send requests
directly to your app's backend?
They might not use your app at all.
Or they might write a copycat app
that uses your API key, thereby not only running up your bill,
but also stealing critical functionality.
You should already have security rules in place
to make sure requests come from authenticated users,
but you will need something else to make sure requests
are coming from your app.
That's where Firebase App Check comes in.
Along with security rules and strong authentication,
it's a key part of the Firebase security suite designed
to protect your app.
Firebase App Check protects your API resources from abuse
by helping prevent unauthorized clients
from accessing your backends.
For frequently accessed backends like databases,
it's helpful to have App Check token last for a short time.
This way, we don't have to go through the relatively
expensive attestation process every time we want to look up
a field in the database.
But what about infrequently accessed but high-value
endpoints where we may need additional security?
You may have recently integrated an AI chatbot
into your app, maybe an ML model or other expensive computation,
or an external API which you depend on.
How can we make sure that a token cannot be stolen
and reused such that future requests are denied?
With the new replay protection in Firebase App Check,
your app can now generate single-use tokens
for specific endpoints without sacrificing performance
in the rest of your app.
Let's take a look at how it works.
Imagine I want to use an API which depends on an API key
that I don't want made available in my app.
I can use a Cloud Function to proxy access
and keep the key secured.
Additionally, I'll use Firebase App
Check with replay protection to ensure my Cloud
Function is secured, which will, in turn, protect
my downstream API.
Here, I've already set up my Cloud Function
to enforce App Check.
By inspecting the context, we can
ensure App Check has attested one of our apps.
Now I'll need to update my function so that it consumes
single-use App Check tokens.
If the function receives a non-single-use token
or a single-use token which has already been used,
the app object will have the consumed field set to true.
I will also need to update my client code to request
a single-use App Check token.
We can start by logging here in the function,
and once the new version of the client code has rolled out,
we can change the logic to reject the request.
Since this is potentially a breaking change,
we recommend that you try this with new endpoints at first.
Remember, App Check is configured by the app
but enforced by the servicer backend.
This means you cannot selectively enforce App Check
per app, since an attacker could just pretend to be
the unenforced app.
You can, however, choose to enforce
App Check on one particular service while monitoring
requests in another.
This is especially important when changing logic
around App Check, like adding additional restrictions
or replay protection.
Using replay protection with single-use App Check tokens can
further improve the security of your app, but as with anything,
there is a trade off.
In this case, your app may take a slight performance
hit each time it needs to obtain a new token.
So keep that in mind when determining which endpoints
require this level of security.
Speaking of protecting services, we
can already use Firebase App Check
to protect a number of Firebase services,
such as Cloud Firestore, Cloud Functions, Cloud
Storage, and Realtime Database.
Today, we are happy to announce that Firebase App Check is now
also integrated in Firebase Auth with Identity Platform.
If you've previously configured App Check for your app,
all you need to do is upgrade to the latest Firebase SDK,
and your app will automatically start forwarding its App Check
context to Firebase Auth.
If you haven't yet upgraded to Identity Platform,
now would be a good reason to see if the upgrade is
right for you.
As before, you will need to wait until the latest
version of your app rolls out to the majority of your users
before enforcing requests to Firebase Auth.
And that's it.
Protecting your user authentication flows
has never been easier than with Firebase App Check.
When Firebase App Check first launched,
it was available in Android, iOS, and web apps.
We're also adding support for Unity and C++ to help game
developers combat some of the most common forms of cheating
in their games.
You can reuse existing platform-level attestation
providers.
For example, if your Unity game runs on iOS and Android
devices, you can use the underlying Apple AppAttest
and PlayIntegrity attestation providers
and automatically switch depending on the platform.
You can also do similar logic in C++.
What about if you have your own method of attesting the device?
App Check comes with support for specifying custom attestation
providers, allowing you to provide your own implementation
for your favorite provider.
You can then write a factory to pass your provider to the App
Check SDK.
With custom providers, you can protect
endpoints called from desktop, IoT, or any other devices
you manage.
By federating attestation through Firebase App Check,
you can ensure that all your endpoints,
whether hosted on Firebase or not,
are able to verify the authenticity of clients
across all the platforms you support using the same API.
Let's take a second to review what we covered.
With replay protection in Firebase App Check,
we can prevent token reuse in our expensive API calls,
like machine learning models and third party APIs.
We learned about protecting user flows
by integrating Firebase App Check
with Firebase Authentication.
We learned how Firebase App Check for the Firebase C++
and Unity SDKs can help game developers combat cheating
in their games.
And finally, we learned about how custom providers can allow
you to federate your own attestation
provider in Firebase App Check.
Give it a try.
Visit the App Check menu within the Firebase Console.
I'm Alex, and thanks for tuning in.
[MUSIC PLAYING]