Firebase Appcheck refuse request for some users

Question

I recently received notifications from some users indicating that my application is not working. This issue has resulted in many uninstallations. After analyzing the problem, it was identified that Appcheck is blocking users from accessing the database .

I've attached a screenshot displaying unverified and invalid requests, and I'm uncertain why this occurs randomly. I've upgraded the SDK, but the issue persists.

   implementation platform('com.google.firebase:firebase-bom:32.7.3')
   implementation 'com.google.firebase:firebase-appcheck-playintegrity'
   implementation 'com.google.firebase:firebase-appcheck-debug'

I'm initializing my FirebaseAppCheck in my Application classe this way as documentation said :

    FirebaseApp.initializeApp(getApplicationContext());
    FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();
    firebaseAppCheck.installAppCheckProviderFactory(
            PlayIntegrityAppCheckProviderFactory.getInstance());

I've extensively researched this issue, but unfortunately, I haven't been able to find a definitive solution. This is particularly distressing as it's impacting my user base, with a loss of more than 200 users per week. I'm still actively seeking a resolution and any assistance would be greatly appreciated

Edit :

i could reproduce the issue on my device , here is the log message :

Firebase Database connection was forcefully killed by the server. Will not attempt reconnect. Reason: Invalid appcheck token

The issue is from version installed from play store , i also tried on another device , and it works ! that's really distressing

Mada

Answer 1

I finally resolved the issue after contacting the Firebase support team. We realized that it was a device integrity issue . the device where i got this message :

Reason: Invalid appcheck token 

has only the MEETS_BASIC_INTEGRITY integrity verdict, while my Play Integrity API was only accepting MEETS_DEVICE_INTEGRITY. This explains why my application was working on the second device. Here are two captures to illustrate the difference.

Capture 1 : device refused to connect

Capture 2 : device connected succesfully

So to resolve this , i added MEETS_BASIC_INTEGRITY into Play Integrity API verdict

Play Console -> Application -> App integrity -> Play Integrity Api settings

then check MEETS_BASIC_INTEGRITY and save .

I also checked MEETS_STRONG_INTEGRITY , and the settings will result like this :

So now that the issue is resolved, you still need to be aware that according to Firebase, opting into this lower level of label does come with a cost of decreased security and should be enabled with caution.

I invite you to read more about Integrity verdicts

Mada