feat(appcheck): Verify one-time tokens for replay protection - #976
feat(appcheck): Verify one-time tokens for replay protection#976yvonnep165 wants to merge 7 commits into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for stateful token verification in Firebase App Check by introducing a consume parameter to the verify_token function. When enabled, the service calls the App Check backend to mark the token as consumed, providing replay protection, and returns an already_consumed flag. Corresponding unit tests have also been added. The review feedback suggests improving error handling by using _utils.handle_platform_error_from_requests instead of _utils.handle_requests_error to propagate detailed GCP error messages to developers.
|
|
||
| verified_claims['app_id'] = verified_claims.get('sub') | ||
|
|
||
| if consume: |
There was a problem hiding this comment.
Let's validate consume is a bool here.
There was a problem hiding this comment.
Thanks for taking a look at this! Validation is added.
2 participants
This PR adds support for App Check one-time token verification for replay protection by adding an optional
consumeparameter toapp_check.verify_token(). The returned claims dictionary will contain analready_consumedboolean key indicating whether the token was previously consumed.