firebase / firebase/firebase-js-sdk
AppCheck with custom provider using HTTPS Callable Function "deadlocks" itself
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### [REQUIRED] Describe your environment
* Operating System version: Windows 11
* Browser version: Chrome 100
* Firebase SDK version: 9.6.10
* Firebase Product: App Check
### [REQUIRED] Describe the problem
Firebase App Check deadlocks itself when using a custom attestation provider and a HTTPS Callable Function for verification as it makes the call to the HTTPS Callable Function for verification wait forever.
Resulting from this discussion: https://github.com/firebase/firebase-js-sdk/discussions/6070
#### Steps to reproduce:
1. I have a Callable Firebase HTTP Cloud Function that verifies the attestation provider's authenticity data
2. I initialize a token on the client using something like this:
```javascript
const appCheckCustomProvider = new CustomProvider({
getToken: async () => {
// ... do something to retrieve the client part
const clientSolution = ...
const verificationFn = httpsCallable(functionsInstance, "verifyClientSolutionAndGenerateAppToken")
const appCheckToken = await verificationFn(clientSolution)
return appCheckToken
},
})
```
So the desired flow is:
1. Client generates its `clientSolution` (using a 3rd party attestation provider)
2. Client calls the Callable HTTP Function to verifiy the `clientSolution` and retrieve an App Check token
The trouble I'm running into is that generating the `clientSolution` works but as soon as we hit the `await verificationFn(..)` line, the browser stops and just stays there forever.
Checking in the network monitor, the browser does not even try to do the fetch call to the cloud function, it just waits.
My guess is that it waits for the `getToken` to complete before executing _any_ Cloud Function call (to be able to put the AppCheck token in the headers).
**Note:** When using a regular HTTP Cloud Function (=not _Callable_ Cloud Function), the deadlock does not occur (see https://github.com/firebase/firebase-js-sdk/discussions/6070#discussioncomment-2440457).
#### Relevant Code:
See above
Contributor guide
Assessment
This issue has not been assessed yet.