App check (web): all requests are unverified ?

[lowzyyy]

Graph is showing:
               100% Unverified: outdated client requests

What does outdated mean ? I am running 9.15.0 firebase

Is this a bug or what can cause request to be unverified?

I am running deployed app on firebase with realtimedatabase.
Its created with create-react-app

[Laurent Payot]

Are you using the Firebase REST API? If so you have to add an `X-Firebase-AppCheck` header with your AppCheck token to your requests. 

I had to do that just like Firebase was "my server", as explained here: https://firebase.google.com/docs/app-check/web/custom-resource#send_tokens_with_backend_requests

[Michael Bleigh]

You might also want to check that you're on the latest version of the JS SDKs.

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/e0bda2b8-dcb7-4c12-9ca8-53fa413e5cf1n%40googlegroups.com.

[lowzyyy]

Yes i use REST api. Tried your approach and now i get all requests as "Unverified: invalid requests". Man this app check does not work at all  and i am on the latest firebaase 😞

[Laurent Payot]

"outdated client requests" meant that you were not using AppCheck at all.

Now with "invalid requests" at least you are doing something with AppCheck ;)

Do you get 403 errors in the network tab of your browser’s devtools ? I used to have the issue described here: https://github.com/firebase/firebase-js-sdk/issues/6708

Yes AppCheck is tricky.  It is also bloated as it injects the recaptcha app in your DOM (almost as big as my entire web app, using two big outdated Roboto fonts for nothing) and ruined all my efforts for a quick app startup. Also if you have a web app say goodbye to SEO as its sole purpose is to prevents non-human browsing. Lighthouse is not working with it also.

 I had to stop using it for my PWA. It might be useful for native apps that are already bloated and do not rely on SEO.

[lowzyyy]

Actually i dont have any errors. I just did all like in the documentation. Using fetch to get data from realtime database. The biggest problem for me is if i put all that code in the right spot. Currently all that app check code is in file where i create some component but it is outside of the component code body. Only getToken is in functions that fetch some data because i am getting token.