[AppCheck] firestore missing or insufficient permissions after a while

[orbachar]

• Browser version: Chrome
• Firebase SDK version: 9.6.1
• Firebase Product: app check

Hey,
I am using app check with reCAPTCHA Enterprise and Cloud Firestore enforced on my webapp.
I also set the token TTL to 30 minutes.

I noticed that after a while when the browser idle, I am getting "FirebaseError: Missing or insufficient permissions." and can't query the DB anymore.

refresh fixes it..
so I believe it is because the token isn't valid anymore, although I enabled auto refresh.

this is the code I am using

        const appCheck = initializeAppCheck(app, {
            provider: new ReCaptchaEnterpriseProvider(appCheckRecaptchaKey),
            isTokenAutoRefreshEnabled: true // Set to true to allow auto-refresh.
        });

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[ehsannas]

Thanks for reporting @orbachar. Would you be able to enable debug messages and provide the debug logs?

you can enable debug messages using setLogLevel

Moreover, if you have an easy repro code that you can share (e.g. via a GitHub repo) that'd speed up our investigation.

Thanks

[orbachar]

attaching logs:

[ehsannas]

Thanks @orbachar . I want to make sure this is indeed an AppCheck issue (rather than an Authentication issue). Can you please confirm that if you turn off AppCheck enforcement for Firestore in the Firebase Console, the issue does not occur anymore?

[orbachar]

yes, I did that again today just to make sure - with AppCheck unenforced for Firestore, it doesn't happen. if I turn on appCheck again, the errors return after some idle time

[ehsannas]

Thanks for confirming @orbachar.

[ehsannas]

@orbachar I was able to reproduce this issue. I'll continue to look into fixing this.