Struggling to implement Firebase App Check for user authentication and permissions

Backend
1

I’m having a hard time with my iOS app that’s already in the App Store. I can’t get Firebase to accept my App Check token. The app works fine when I set the rules to allow all access, but when I try to enforce App Check, I get a “Missing or insufficient permissions” error.

I’ve done the following:

  • Set up DeviceCheck and App Attest in Firebase
  • Turned on App Check enforcement
  • Added the correct GoogleService-Info.plist file

My code seems to get App Check tokens, but Firestore access still fails. Here’s a simplified version of what I’m trying:

func checkAppAndFirestore() {
    AppCheck.shared.getToken { token, error in
        if let token = token {
            print("Got token: \(token.token)")
            self.testFirestore()
        } else {
            print("Token error: \(error?.localizedDescription ?? \"Unknown\")")
        }
    }
}

func testFirestore() {
    Firestore.firestore().collection("tests").document("sample").getDocument { doc, error in
        if let error = error {
            print("Firestore error: \(error.localizedDescription)")
        } else {
            print("Firestore success: \(doc?.data() ?? [:])")
        }
    }
}

I’m out of ideas and need help getting App Check to work properly. Any suggestions?

2

hey there, i’ve dealt with similar issues. have u double-checked ur firebase project settings? sometimes the app ID doesn’t match up. also, try clearing the app’s data/cache on ur test device. that fixed it for me once. good luck!

3

I encountered a similar issue when implementing App Check. One crucial step that’s often overlooked is ensuring that your app’s bundle ID in Xcode matches exactly with the one registered in Firebase Console. Additionally, verify that you’ve properly configured the SHA-1 and SHA-256 fingerprints for your app in the Firebase Console. These mismatches can cause authentication failures even when the code seems correct.

Another potential solution is to implement a custom App Check provider for debugging purposes. This can help isolate whether the issue is with App Check itself or with your Firestore rules. Remember to remove the custom provider before submitting to the App Store.

Lastly, double-check your Firestore security rules. Ensure they’re correctly set up to work with App Check tokens. Sometimes, the rules themselves can be the culprit, even when App Check is functioning properly.