firebase / firebase/firebase-android-sdk

[firebase-appcheck-debug] Print debug token on every provider initialization instead of only when generated

Open
#8,413 0 comments 0 reactions 0 assignees View on GitHub
api: app-check
Dominant language
Java
Stars
2.6k
Forks
710
Avg merge
2d 23h
Merged PRs (30d)
34

Description

### Environment
- **Firebase Component:** App Check Debug (`firebase-appcheck-debug`)

### Problem Description
Currently, `DebugAppCheckProvider` logs the debug secret (`Log.d(TAG, "Enter this debug secret into the allow list in the Firebase Console for your project: ...")`) when generating a new debug secret during initialization.

This behavior has two major drawbacks:
1. **Not printed on subsequent initializations:** If the secret was already generated on a previous run, or if logcat was cleared, subsequent app initializations / runs do not print the debug secret if it was only logged during the single initial generation event or if custom secret providers are used.
2. **Custom Secret Providers:** When an `InternalDebugSecretProvider` is configured, `determineDebugSecret()` is skipped entirely, meaning the debug token is never printed to logcat upon initialization.

### Proposed Solution
Update `DebugAppCheckProvider` so that every time the provider is initialized (including when an existing token is loaded from storage or provided via `InternalDebugSecretProvider`), the debug secret is printed to logcat.

Contributor guide

Open the contributing guide

Research direction

Start with DebugAppCheckProvider and trace its initialization path, including determineDebugSecret() and the InternalDebugSecretProvider case. Check the generated, stored, and custom-provider flows using logcat; done means the debug secret is printed on every provider initialization.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, firebase, java
Domain
mobile, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.