67

I got this warning when I was publishing my app

The developer of play-services-safetynet (com.google.android.gms:play-services-safetynet) has reported critical issues with version 17.0.0. Consider upgrading before publishing a new release.

Here's what the SDK developer told us: The SafetyNet Attestation API is being discontinued and replaced by the new Play Integrity API. Begin migration as soon as possible to avoid user disruption. The Play Integrity API includes all the integrity signals that SafetyNet Attestation offers and more, like Google Play licensing and better error messaging. Learn more and start migrating at https://developer.android.com/training/safetynet/deprecation-timeline

How do I remove the critical issue and get my app into production?

Doing Things Occasionally
  • 796
  • 2
  • 13
  • 42
Ahmad Alaraj
  • 695
  • 1
  • 5
  • 5
  • 8
    I got this warning too, although I don't use safety net anywhere in my code. It's actually the first time I hear that it exists. – mathematics-and-caffeine Jul 10 '22 at 09:06
  • 19
    It seems that Firebase-Auth is using this `com.google.android.gms:play-services-safetynet` – Deepak Goyal Jul 11 '22 at 12:45
  • I am getting the same warning, but I actually do not have `safetynet` anywhere in my code. I am using Firebase-Auth, so it may be coming from there. Is there a way to solve this without just excluding it? – Dennis Ashford Jul 17 '22 at 11:07
  • I am also facing same issue, My app got crashed after installing. I used firebase-auth not safetyNet. Any work around for this for react-native ? – Rajat.r2 Jul 18 '22 at 09:17
  • 3
    I also got this warning for my flutter app. But will the app be released with this warning? Review is taking really long time. – kragekjaer Jul 21 '22 at 08:23
  • We use only recaptcha from safetynet, but still recently got this message, the version 18.0.1. The problem is new integrity api has no captcha as I see in the docs. So, are they going to add it there soon and when we need to migrate or they will remove this warning? – Aleksandr Urzhumtcev Jul 26 '22 at 10:13
  • There is an [open issue](https://github.com/firebase/firebase-android-sdk/issues/3890) in FIrebase GitHub. Flutterfire plugins [can do nothing](https://github.com/firebase/flutterfire/issues/9085) until it is fixed on the native level. – Ruslan Bakeyev Sep 20 '22 at 09:05

2 Answers2

19

SafetyNet is a set of APIs from Google Play Services for developers to ensure that apps are running in a safe environment. It is optional for app developers, and app developers can choose to use it or not. SafetyNet prevents an app from working if an app’s developer doesn’t want it to work on devices which are rooted, tampered, running custom ROM, or infected with malware.

Banking apps, Snapchat and Netflix are examples that uses something called SafetyNet to detect whether your device is rooted or not, and blocks access to those features.

For those apps which are using SafetyNet:

In June 2022, Google announced that we should start integrating with the Play Integrity API as soon as possible. The Play Integrity API includes all the integrity signals that SafetyNet Attestation offers and more. SafetyNet Attestation will continue to work for your app as of now.

At the end of June 2023, developers that have migrated to the new API will be able to continue using the old SafetyNet Attestation on older versions of their apps, but those that have not migrated will not be able to do so.

At the end of June 2024, Google says SafetyNet Attestation will be retired entirely.

Gaurav Singh
  • 1,177
  • 12
  • 16
  • 1
    I am also facing same issue, My app got crashed after installing. I used firebase-auth not safetyNet. Any work around for this for react-native ? – Rajat.r2 Jul 18 '22 at 09:17
  • This won't be a reason of crash in your app as you are not using safetyNet. So, it is showing you just a warning because of firebase using some code related to it. Better to use crashAnalytics to debug the actual reason of crash. – Gaurav Singh Jul 18 '22 at 11:25
  • 1
    Ok. I created .aab file for play store then I download app from bundle explorer. This APK is got crashed. but I also have release build APK with no changes and it's working fine. Don't know .aab file converted by play store not working. – Rajat.r2 Jul 18 '22 at 13:04
13

If you are not using safety net anywhere just do the below changes in your code.

implementation platform('com.google.firebase:firebase-bom:30.2.0')
    implementation 'com.google.firebase:firebase-core'
    implementation('com.google.firebase:firebase-auth') {
        exclude module: "play-services-safetynet"
    }
sukhbeer
  • 240
  • 1
  • 7
  • So the problem is related only to firebase-auth?,or is there another dependency that is using safetynet? – dicarlomagnus Jul 12 '22 at 00:48
  • 2
    I found it only in firebase auth till now – sukhbeer Jul 12 '22 at 02:08
  • 39
    Why would the exclusion of the module be the solution here? Surely we should be getting an updated firebase auth sdk from google since it is their products using their products? – Pieter van der Vyver Jul 13 '22 at 09:01
  • 4
    @PietervanderVyver I Hope, it would be solved in the updated firebase auth SDK but till now I only got this solution. – sukhbeer Jul 13 '22 at 12:12
  • Has anyone found if this causes any problems by excluding play-services-safetynet? – mliu Jul 15 '22 at 04:58
  • 4
    when i added this.. its not sending OTP to mobile number. show error toast. so removed it now its working.. will not work for phone number auth in my case. – vignesh Jul 15 '22 at 05:43
  • I am also facing same issue, My app got crashed after installing. I used firebase-auth not safetyNet. Any work around for this for react-native ? – Rajat.r2 Jul 18 '22 at 09:17
  • 1
    Will the app be published even though this warning? – kragekjaer Jul 21 '22 at 11:21
  • @kragekjaer you can publish your app on the play store with this warning but google sent you a critical warning message in you play console inbox for same warning – sukhbeer Jul 28 '22 at 06:16
  • This didn't removed the warning on play-console @sukhbeer, do you have suggestions to move out of the warning, or how would be able to migrate. Even the app is not rejected, but taking more the 4+ days, don't know why. – neon97 Sep 05 '22 at 06:56
  • @neon97 I've just exclude module: "play-services-safetynet" from firebase-auth and it work I think you need to test your dependencies tree it might be possible that apart from auth library other dependencies use it internally – sukhbeer Sep 05 '22 at 07:58
  • Does Firebase Auth still work properly when you exclude this? Does 2FA work properly? This doesn't seem to be the best solution, Firebase is a part of Google and if Google discontinues SafetyNet, Firebase should remove this from their code. – mathematics-and-caffeine Sep 16 '22 at 11:26
  • Indeed, the application takes a very long time to be moderated, they probably put it to the test in much more detail, I'm still waiting... The exception listed here as a solution worked for me when I published my other application everything went without a warning in PlayConsole, but I don't use firebase-auth – W.Studio Sep 21 '22 at 16:56
  • 28
    Please do not exclude the safety net module from the auth library, it might break the code. Ignore the warning for now. This warning is nothing but a miscommunication between firebase and the google team. Firebase auth uses safety net attestation API internally(which is deprecated) and THEY need to perform the migration and not us. https://github.com/firebase/firebase-android-sdk/issues/3890 – Harshal Pudale Oct 04 '22 at 06:35
  • Don't use this solution if you are using firebase authentication with flutter, it will break your app! Just like others have said in this thread, you can ignore the warning for now and publish your app. – Eric Su Dec 27 '22 at 08:55