FirebaseAppCheck.getAppCheckToken(true) does not appear to force refresh all the time?

[mikehardy]

[READ] Step 1: Are you in the right place?

Issues filed here should be about bugs in the code in this repository.
If you have a general question, need help debugging, or fall into some
other category use one of these other channels:

• For general technical questions, post a question on StackOverflow
  with the firebase tag.
• For general Firebase discussion, use the firebase-talk
  google group.
• For help troubleshooting your application that does not fall under one
  of the above categories, reach out to the personalized
  Firebase support channel.

[REQUIRED] Step 2: Describe your environment

• Android Studio version: 7.0.2
• Firebase Component: AppCheck
• Component version: from BoM 28.4.0

[REQUIRED] Step 3: Describe the problem

Steps to reproduce:

If you call these two methods back to back the tokens are equal in certain cases. Is that expected? Shouldn't force refreshing the token always get a new token? 🤔

pseudo-code:

token1 = FirebaseAppCheck.getAppCheckToken();`
token2 = FirebaseAppCheck.getAppCheckToken(true);

// sometimes token1 == token2?
// But then if you wait 5 seconds and re-try both back to back you will get token1 != token2 

Relevant Code:

We test this case here, you can run it

https://github.com/invertase/react-native-firebase/blob/90b4d7021aff7d5d28140b57eb69283b04712257/packages/app-check/e2e/appcheck.e2e.js#L54-L65

The (boring, by the book) Java code it exercises is:

https://github.com/invertase/react-native-firebase/blob/90b4d7021aff7d5d28140b57eb69283b04712257/packages/app-check/android/src/main/java/io/invertase/firebase/appcheck/ReactNativeFirebaseAppCheckModule.java#L73-L95

This same test found an actual crash in the firebase-ios-sdk which was just resolved firebase/firebase-ios-sdk#8544 - so perhaps this is just an unexpected (though still valid) use case?

Or perhaps my expectations of the API are incorrect?

Any insight appreciated - thanks!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[mikehardy]

side note, there's no api:appcheck label, so it's hard to search for app check issues

[aguatno]

Hi @mikehardy thanks for reporting. Based on the documentation it says there that it should give you a Firebase App Check token. Let me check with the team if this is expected or a possible bug.

[aguatno]

Hi @rosalyntan could you help me check if this is expected? Does getAppCheckToken(true) force refresh to get a new token? I've uploaded a sample mcve here to test the behaviour. Thanks

[rosalyntan]

My hunch is that this may be occurring because I don't think order of execution is guaranteed when you submit the Callable to the ExecutorService here:
https://github.com/invertase/react-native-firebase/blob/90b4d7021aff7d5d28140b57eb69283b04712257/packages/app-check/android/src/main/java/io/invertase/firebase/appcheck/ReactNativeFirebaseAppCheckModule.java#L75-L80

and what may be happening is that sometimes FirebaseAppCheck.getAppCheckToken(true) is being executed before FirebaseAppCheck.getAppCheckToken() (resulting in them returning the same token).

[mikehardy]

Hmm - I just re-read that line in our module to see if there was some action we could/should take and given the API call into the firebase-android-sdk is a single line I don't think we can do anything to impact order of operations and guarantee fresh token? I ask that for confirmation, since obviously if our code is buggy I'd love to know so I can focus personal effort and fix it :-). Only other thing I can think of is to perhaps test for a true parameter to the function and then do a sort of retry loop until the token really was refreshed but that would be a workaround for a still-in-error underlying issue, if I'm understanding correctly.