I am using a node js server as a middle man to perform extra functions based on the request from the android client in order to reduce the client side computations. So when my client makes request to my server, i get the appCheck client token included in the request. Now my server performs additional functions and updates the data in cloud firestore. But how do i send the appCheck token to firestore with the crud request, so that it follows the appCheck as well as the security rules in firebase. I can achieve this functionality with the admin-sdk but it will neglect the security rules, which may also allow unauthorised requests to perform. Please help me out with this.
1 Answers
As far as I know there is no way for you to pass the App Check token on to Firestore. But even if there was, there is no information from the App Check token that ends up in the security rules.
What I'd recommend doing instead is to validate the App Check token in Cloud Functions yourself. This ensures that calls to your Cloud Functions will only be allowed from attested environments, so it can then make the call to Firestore knowing it is servicing an attested app.
Related