0

I have a React-Native app and I am using the firebase SDK for React-Native. I have just implemented App-Check for my app and it works fine in debugging mode, but it fails in Release. Here is the code for app-check in index.js which is triggered as soon as app is initialized:

 try {
   firebase.appCheck().setTokenAutoRefreshEnabled(true);
   firebase.appCheck().activate('ignored', true);
   firebase.appCheck().getToken(true).then(res => {
      GLOBAL.app_check = JSON.stringify(res.token);
      console.log("app check success, appchecktoken: " + JSON.stringify(res.token));
   }).catch((error) => {
      GLOBAL.app_check = '';
      console.error("app check failed: " + error); 
      alert('App check failed: ' + JSON.stringify(error));
      return;
   });
} catch (e) {
   console.log("Failed to initialize appCheck:", e);
   logErrors('appCheck failed: ', e);
}

as you can see above, I am using alert to print the error message but here it what it prints:

**App check failed: {} **

.. object is empty. How can I check what's wrong with it? I am using Play Integrity and SafetyNet and I have added the SHA-252 which I got by using Gradle's Signing Report via the following command:

gradlew signingReport

What am I doing wrong here?

showtime
  • 1
  • 1
  • 17
  • 48
  • You need to also get the sha256 cert fingerprint for all your signing keys. On Android this would be your upload key and if you are deploying to Google play, it would be the Google play store signing key. The gradle signingreport only gives you the debug key if I recall correctly – Alexander N. Oct 23 '22 at 03:07

1 Answers1

1

You will need to get the SHA-256 for all signing keys used with your app. With debug keys, calling gradlew signingReport works as it goes to the default signing key location (~/.android/debug.keystore) and runs the java keytool against this keystore supplying the default alias (android) and password (android).

For your release keys, which are self generated, you would need to use the java keytool which can generally be found on your system path or within the jdk directory. If you need help setting up keytool, I would refer to this stackoverflow question. You could use any other variations of keytool that exist, but I would use the one that ships with the jdk as its generally trusted. The command you would then want to run using keytool would be:

keytool -list -v -alias ${alias_of_keystore} -keystore ${location_of_keystore}

You would want to sub the alias and location with your own values. Using the default debug key values, the command would look something like this:

keytool -list -v -alias android -keystore ~/.android/debug.keystore

This video talks about all the different locations to grab the SHA-256. For instance, after you upload to the Google Play Store, if you opt into Google Play Signing (which I believe is the default) you will need to grab the SHA-256 from there as well. The rest of the video covers digital asset links and can be ignored.

Alexander N.
  • 1,458
  • 14
  • 25