FirebaseAppCheck.getAppCheckToken(true) does not appear to force refresh all the time?

[READ] Step 1: Are you in the right place?

Issues filed here should be about bugs in the code in this repository. If you have a general question, need help debugging, or fall into some other category use one of these other channels:

• For general technical questions, post a question on StackOverflow with the firebase tag.
• For general Firebase discussion, use the firebase-talk google group.
• For help troubleshooting your application that does not fall under one of the above categories, reach out to the personalized Firebase support channel.

[REQUIRED] Step 2: Describe your environment

• Android Studio version: 7.0.2
• Firebase Component: AppCheck
• Component version: from BoM 28.4.0

[REQUIRED] Step 3: Describe the problem

Steps to reproduce:

If you call these two methods back to back the tokens are equal in certain cases. Is that expected? Shouldn’t force refreshing the token always get a new token? 🤔

pseudo-code:

token1 = FirebaseAppCheck.getAppCheckToken();`
token2 = FirebaseAppCheck.getAppCheckToken(true);

// sometimes token1 == token2?
// But then if you wait 5 seconds and re-try both back to back you will get token1 != token2 

Relevant Code:

We test this case here, you can run it

https://github.com/invertase/react-native-firebase/blob/90b4d7021aff7d5d28140b57eb69283b04712257/packages/app-check/e2e/appcheck.e2e.js#L54-L65

The (boring, by the book) Java code it exercises is:

https://github.com/invertase/react-native-firebase/blob/90b4d7021aff7d5d28140b57eb69283b04712257/packages/app-check/android/src/main/java/io/invertase/firebase/appcheck/ReactNativeFirebaseAppCheckModule.java#L73-L95

This same test found an actual crash in the firebase-ios-sdk which was just resolved https://github.com/firebase/firebase-ios-sdk/issues/8544 - so perhaps this is just an unexpected (though still valid) use case?

Or perhaps my expectations of the API are incorrect?

Any insight appreciated - thanks!

[aguatno]

Hi @mikehardy thanks for reporting. Based on the documentation it says there that it should give you a Firebase App Check token. Let me check with the team if this is expected or a possible bug.

[mikehardy]

Hmm - I just re-read that line in our module to see if there was some action we could/should take and given the API call into the firebase-android-sdk is a single line I don’t think we can do anything to impact order of operations and guarantee fresh token? I ask that for confirmation, since obviously if our code is buggy I’d love to know so I can focus personal effort and fix it 😃. Only other thing I can think of is to perhaps test for a true parameter to the function and then do a sort of retry loop until the token really was refreshed but that would be a workaround for a still-in-error underlying issue, if I’m understanding correctly.