Verifying app identity with App Check
summary
Firebase App Check verifies that requests really come from your app by exchanging attestation artifacts for tokens and enforcing them on Firebase products. It integrates with SafetyNet and reCAPTCHA (iOS gets App Attest/Device Check soon), supports custom attestation, and plugs into Cloud Storage, Realtime Database, and Cloud Functions. Console metrics split traffic into verified, unverified — likely outdated (example: 40%), unknown, and malicious; turning on enforcement rejects requests without valid App Check tokens.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:33Firebase Authentication
- 3:02App Attestation
- 4:04What Attestation Providers Are Supported on App Check on Android App
- 4:56Custom Attestation Integration
- 6:31App Registration
- 7:19Register an Application in the Firebase Console
- 7:36Register Your App
- 8:48Monitoring App Check Traffic
- 9:18Verified Requests
- 9:35Unverified Likely Outdated Requests
- 10:29Unverified Unknown Origin
- 10:45Unverified Malicious Requests
- 11:01App Check Enforcement
- 11:51Developing a New App When Should I Enforce Appcheck
related talks
14mHow to use App Check to protect your custom backend
40mThree New Ways to Secure Your App with Firebase Authentication
25mFive tips to secure your app
14mYour guide to server side authentication with Firebase
09mProtecting APIs with DeviceCheck, App Attest & WebAuthn
13mSecure your Firebase app from the start
39mAndroid App Security Fundamentals
14mDemystifying attestation