1

I would like to know if my Firebase Backend (Firestore and Cloud Functions) are safe by using App Check if my Flutter App (iOS/Android) is reverse engineered.

I imagine the App Check is client based. If the client is reverse engineered, then the backend wouldn't know if it's "my" client or the "bad" client which was reverse engineered?

coor_angar
  • 93
  • 7

1 Answers1

2

App Check works with so-called attestation providers on each supported platform to attest that API calls come from your genuine code on a genuine device. These providers are at this point quite well vetted on both iOS and Android, and are getting better on Web.

For example, without App Check a malicious user can extract the Firebase configuration from the released app, and then for example call the Firestore APIs with those configuration details. You'd then use security rules to protect against the attack.

When you use App Check, their API calls won't be attested, so they will be rejected by Firebase before they even reach Firestore and your security rules. So with one sweep, you've ruled out a lot of abuse on that attack vector.

But there is still a potential for abuse, even when you use App Check. That's why you should always combine App Check with other security measures, such as the server-side security rules that exist for Firestore (since you tagged with that) and other Firebase products.

I recommend also checking out:

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
  • Thanks a lot. I have set up Security Rules. My question remains: is it possible to make API calls with a reversed engineered version of my app (if App Check is set up)? – coor_angar Jan 05 '23 at 18:43
  • Yup, there is still a potential for abuse, even when you use App Check. Also see: https://firebase.google.com/docs/app-check#how_strong_is_the_security_provided_by. And yes, both my answer and that link are intentionally not mentioning specific attack vectors.. – Frank van Puffelen Jan 05 '23 at 18:50
  • Ok, thanks for the explanation. Could you tell me why you don't mention it intentionally? I am an absolute newbie but it's interesting why you don't mention it if it's a risk - if not the biggest one. – coor_angar Jan 05 '23 at 19:09