Implement App Check auto refresh timing and opt out flag #4847
Conversation
|
Binary Size ReportAffected SDKs
Test Logs
|
| @@ -108,7 +112,8 @@ export async function getToken( | |||
| */ | |||
| try { | |||
| if (state.customProvider) { | |||
| token = await state.customProvider.getToken(); | |||
| const customToken = await state.customProvider.getToken(); | |||
| token = { ...customToken, issuedAtTimeMillis: Date.now() }; | |||
There was a problem hiding this comment.
the customToken might be issued earlier than the current timestamp. It might be okay to assume it to be the current timestamp for the purpose of determining the refresh time, but is it the case? We should add comments to clarify.
There was a problem hiding this comment.
I might be misunderstanding but I think that if it was issued earlier, it would be in the cache and this function would have returned in line 105? Once it's fetched here it'll be written to storage in line 144. Unless the custom getToken() method has its own code to read/write from its own separate cache, where someone might have wiped Firebase AppCheck's cache but didn't wipe out the user's custom cache??, which, should we worry about that?
There was a problem hiding this comment.
It could happen when customProvider.getToken() executes for the first time before cache comes into play. Since customProvider is implemented by developers, it can return a token created 3 hours ago or 2 days ago.
hsubox76
force-pushed
the
ch-appcheck-optout
branch
from
8a23ed1 to
60447d2
Compare
Implement global opt-out. API proposal is here: https://docs.google.com/document/d/17RZDbKMRtgHoRGcyAR_KIAHPStr2aFnJmFsffO50pRI/edit?hl=en&forcehl=1#
Implement auto-refresh timing. Formula is
issuedAtTime + (50% * TTL) + 5 minutesfrom here: https://docs.google.com/document/d/1fi4xUsARCs3Uc8c46KvNiIf2rQeWnjxvODW-h0coSmo/edit?resourcekey=0-IK3tvAt8BxEmzoOHbbRfcg&disco=AAAAIUhr8kEThe second required an additional
AppCheckTokenInternaltype to be created that extendsAppCheckTokenwith aissuedAtTimeMillisfield, which is needed to calculate the auto refresh time. This info can also be extracted from the token, but I am following Android's example of adding this data to an internal token type using the local client's clock to avoid clock skew (the issued-at-time in the token is server time).