@firebase/app-check

What is @firebase/app-check?

The @firebase/app-check npm package is part of the Firebase suite of cloud services designed to protect your Firebase web and mobile backends from abuse, such as billing fraud or phishing. It works by ensuring that only your app's legitimate instances can access your Firebase services.

What are @firebase/app-check's main functionalities?

Initialize App Check with reCAPTCHA

This code initializes Firebase App Check using a reCAPTCHA V3 provider. It helps in defending the Firebase backend by ensuring that interactions are coming from your app's legitimate instances.

import { initializeApp } from 'firebase/app';
import { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check';

const app = initializeApp({ /* your firebase config */ });
const appCheck = initializeAppCheck(app, {
  provider: new ReCaptchaV3Provider('your-recaptcha-site-key'),
  isTokenAutoRefreshEnabled: true
});

Initialize App Check with Custom Provider

This code snippet demonstrates how to initialize Firebase App Check using a custom token provider. This is useful when you have specific security measures or existing infrastructure that generates tokens for client apps.

import { initializeApp } from 'firebase/app';
import { initializeAppCheck, CustomProvider } from 'firebase/app-check';

const app = initializeApp({ /* your firebase config */ });
const appCheck = initializeAppCheck(app, {
  provider: new CustomProvider({
    getToken: () => {
      // logic to fetch a token from your server
      return fetch('/my-server/get-token').then(response => response.json());
    }
  }),
  isTokenAutoRefreshEnabled: true
});

Other packages similar to @firebase/app-check

csurf

csurf is a middleware for Express applications that provides CSRF token protection. Unlike @firebase/app-check, which is designed specifically for Firebase services, csurf can be used with any web application to add a layer of security against cross-site request forgery attacks.

helmet

Helmet helps secure Express apps by setting various HTTP headers. It's not directly comparable to @firebase/app-check, which provides app-specific tokens to protect backend services, but Helmet contributes to overall application security by configuring headers that protect against common vulnerabilities.

README

@firebase/app-check

App Check SDK