feat(appcheck): Verify one-time tokens for replay protection - #976
feat(appcheck): Verify one-time tokens for replay protection#976yvonnep165 wants to merge 7 commits into
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Code Review
This pull request adds support for stateful token verification in Firebase App Check by introducing a consume parameter to the verify_token function. When enabled, the service calls the App Check backend to mark the token as consumed, providing replay protection, and returns an already_consumed flag. Corresponding unit tests have also been added. The review feedback suggests improving error handling by using _utils.handle_platform_error_from_requests instead of _utils.handle_requests_error to propagate detailed GCP error messages to developers.
Sorry, something went wrong.
There was a problem hiding this comment.
LGTM with one comment, Thanks!
Sorry, something went wrong.
|
|
||
| verified_claims['app_id'] = verified_claims.get('sub') | ||
|
|
||
| if consume: |
There was a problem hiding this comment.
Let's validate consume is a bool here.
Sorry, something went wrong.
There was a problem hiding this comment.
Thanks for taking a look at this! Validation is added.
Sorry, something went wrong.
This PR adds support for App Check one-time token verification for replay protection by adding an optional consume parameter to app_check.verify_token(). The returned claims dictionary will contain an already_consumed boolean key indicating whether the token was previously consumed.