[AppCheck] is it fine to set self.FIREBASE_APPCHECK_DEBUG_TOKEN to true in production?

[ZYinMD]

Currently, to use app check debug token on local development, one prerequisite is to set self.FIREBASE_APPCHECK_DEBUG_TOKEN = true.

Since it must be set before firebase is imported, the best bet is to do it in the html file. However, doing it in the html file makes it less convenient to disable it in production builds.

So my question is, what happens I left it true in production?

1. Will it cause one more http call to some server?
2. Will it affect performance by running through some code blocks unnecessarily ?
3. Will it simply bypass AppCheck in production?

If the answer is no and no, why not remove this step and set it to true for everybody by default?

[hsubox76]

If you leave FIREBASE_APPCHECK_DEBUG_TOKEN set to true in production or in any mode, it will use the debug token cached in IndexedDB if it exists, and if it does not exist, will generate a new one and console.log it with the message to add it in the Firebase Console. If you set FIREBASE_APPCHECK_DEBUG_TOKEN to a string, it will use that string first instead of looking in IndexedDB. In all of these cases, it will ignore the reCAPTCHA or custom provider you provide in initializeAppCheck().

You must set it to not true, and not a string, in order for it to use reCAPTCHA (or a custom provider).

[ZYinMD]

Thanks for the explanation! After testing myself, I'll sum it up in simpler terms: Do not set it to true in production, otherwise appcheck will not pass.

(Sorry I should've tried it before asking. Actually I thought I tried and succeeded, but that must've been false memory)

[ZYinMD]

So, what's your suggestion on how to turn it off in production? Is it safe to do something like this?:

<script>
  if (location.hostname === 'localhost') self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
</script>
<script src="app.js"></script>

[Feiyang1]

This looks good since you are using FIREBASE_APPCHECK_DEBUG_TOKEN as a boolean flag, so the actual debug token string you registered in console is not leaked to your customers.

You definitely don't want to do the following

<script>
  // BAD!!! DO NOT DO IT. Anyone can use the debug token string to bypass appcheck.
  if (location.hostname === 'localhost') self.FIREBASE_APPCHECK_DEBUG_TOKEN = 'MY_DEBUG_TOKEN_STRING';
</script>

Alternative
If you are using any build tool, you can make 2 build configs, one for dev and one for production, and you only set the flag to true for the debug config.

[hsubox76]

We're planning to make some changes so that debug mode is set in the initializeAppCheck() function and not on registration (so you don't have to use the script tag in the index.html anymore).

[relisora]

Any updates on this? This would be extremely convenient to use but I cannot find follow ups anywhere

[guillaumeprevost]

@engelrolling

With Firebase v9, it is possible to do it just before the initialization of App Check, from what I can see here :
https://firebase.google.com/docs/app-check/web/debug-provider#localhost

[Saleh-Salem]

what is the params name for FIREBASE_APPCHECK_DEBUG_TOKEN in body, I need to pass it as params in api