AppCheck SDK doesn't generate tokens for legitimate devices

[diomidispapas]

Description

After integrating and using AppCheck SDK on production for 2 weeks, we observed that. 7.76% fail to generate an integrity token on iOS and more ~20% on Android fails to generate integrity token.

Reproducing the issue

No response

Firebase SDK Version

8.10.0

Xcode Version

13.2.1

Installation Method

Carthage

Firebase Product(s)

App Check

Targeted Platforms

iOS

Relevant Log Output

No response

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

Replace this line with the contents of your Package.resolved.

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[ncooke3]

Hi @diomidispapas, sorry for the trouble. Do you have information regarding the OS version of devices that are not generating an App Check token?

[diomidispapas]

@ncooke3 I wasn't able to observe anything pattern in terms of OS versions. I can see a lot of failures on iOS 15.6, 14.1 as well as 16.0 beta. Yesterday 6% of all devices failed to generate a token on iOS

Similar picture on Android with higher failure rate around 20% with Androids 10,11,12.

[ncooke3]

@ncooke3 I wasn't able to observe anything pattern in terms of OS versions. I can see a lot of failures on iOS 15.6, 14.1 as well as 16.0 beta. Yesterday 6% of all devices failed to generate a token on iOS

Similar picture on Android with higher failure rate around 20% with Androids 10,11,12.

Thanks @diomidispapas for the info. For your AppCheck integration in your iOS app, what attestation provider are you using?

Likewise for Android?

cc: @rosalyntan

[diomidispapas]

On iOS App Attest & Device Check and Play Integrity on Android

[diomidispapas]

@ncooke3 @rosalyntan Is there a way to investigate why there are so many tokens not generated ? Is it an issue of App Check or underlying attestation providers ?

[ncooke3]

Hi @diomidispapas,

Apologies for the delay in response. I've done some investigation and my leading suspicion is that this is with the actual attestation providers. See this Apple forums thread, for example.

You mention this is happening for "legitimate devices", I'm curious how confirmed such devices to be legitimate?

Anyhow, this may be tricky to debug if it is indeed the attestation providers. I'm looking into what we can do to further investigate. I'll update the thread when I have some actionable info.