firebase / firebase/firebase-js-sdk

AppCheck with custom provider using HTTPS Callable Function "deadlocks" itself

Open
#6,176 4 comments 0 reactions 0 assignees View on GitHub
api: appcheck bug internal-bug-filed v9
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### [REQUIRED] Describe your environment

* Operating System version: Windows 11
* Browser version: Chrome 100
* Firebase SDK version: 9.6.10
* Firebase Product: App Check

### [REQUIRED] Describe the problem
Firebase App Check deadlocks itself when using a custom attestation provider and a HTTPS Callable Function for verification as it makes the call to the HTTPS Callable Function for verification wait forever.

Resulting from this discussion: https://github.com/firebase/firebase-js-sdk/discussions/6070

#### Steps to reproduce:

1. I have a Callable Firebase HTTP Cloud Function that verifies the attestation provider's authenticity data
2. I initialize a token on the client using something like this:
```javascript
const appCheckCustomProvider = new CustomProvider({
getToken: async () => {
// ... do something to retrieve the client part
const clientSolution = ...

const verificationFn = httpsCallable(functionsInstance, "verifyClientSolutionAndGenerateAppToken")
const appCheckToken = await verificationFn(clientSolution)

return appCheckToken
},
})
```

So the desired flow is:
1. Client generates its `clientSolution` (using a 3rd party attestation provider)
2. Client calls the Callable HTTP Function to verifiy the `clientSolution` and retrieve an App Check token

The trouble I'm running into is that generating the `clientSolution` works but as soon as we hit the `await verificationFn(..)` line, the browser stops and just stays there forever.
Checking in the network monitor, the browser does not even try to do the fetch call to the cloud function, it just waits.
My guess is that it waits for the `getToken` to complete before executing _any_ Cloud Function call (to be able to put the AppCheck token in the headers).

**Note:** When using a regular HTTP Cloud Function (=not _Callable_ Cloud Function), the deadlock does not occur (see https://github.com/firebase/firebase-js-sdk/discussions/6070#discussioncomment-2440457).
#### Relevant Code:
See above

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.