🐛 [firebase_app_check] Add support to nonce in getToken function

[lucasgsa]

Context

I have developed an application that sends sensitive information, which should only be transmitted by the application itself. To ensure security, the integrity token is validated in the backend API.

To prevent man-in-the-middle attacks, I need to hash the request content and have the backend verify that the hash of the received request matches the nonce.

Having this feature in my application is of utmost importance. If it is not supported, I won't be able to use the library.

Expected behavior

FirebaseAppCheck.getToken(nonce: String)

[waazeved]

I have the same problem

[nohe427]

Accidentally posted a little too soon, and realized I misread what you had originally typed. Here is the new response:

Spoke with the team, this is something that are exploring but in the meantime we offer limitedUseAppCheck tokens which may not address your specific problem, but can help mitigate replay attacks against your backend resources for the time being.

[weixifan]

Thank you for this feature request. To add more color on @nohe427's response, this feature is sometimes known as content binding, as you are binding information about the request into the signed token itself, thus limiting the purposes for which the token can be used when backends check for it. Hashing the request itself is the most common use of this feature, but it is not the only one.

When weighing our next priorities, we decided to first work on the one-time-use token use case that @nohe427 mentioned above, as that is the more common feature developers have been asking for. While we won't be able to give you a timeline, rest assured that we are fully aware of content binding as an important use case.

[russellwheatley]

This is a feature request upstream of FlutterFire which is a wrapper around the native Firebase SDKs.

[hiarlyfs]

I can relate, as I'm facing a similar challenge.

[guilhermeg2k]

This feature is also blocking the use of the library for me, my team won't let me use it for security reasons until it's supported

[ledica]

I am also experiencing the same problem. The lack of nonce support in the function is a limitation that, in my case, makes its use unfeasible.

[TarekkMA]

Thank you for highlighting this missing feature.

Since FlutterFire is a wrapper around the native SDKs, we suggest posting a new idea on Firebase UserVoice: Firebase UserVoice or opening a new issue in the relevant native SDK repository (iOS/Android/JS/etc). Once the feature is implemented on the native side, we can implement it in FlutterFire as well.

I will be closing this issue for now.