How to use App Check to protect your custom backend
summary
App Check verifies that incoming requests come from an authentic app on an attested device or hosted domain and shows how to enforce it across Firestore, Storage, Realtime DB, Cloud Functions, custom backends and Apigee. Demos configure App Attest (iOS 14+) and DeviceCheck fallback, add reCAPTCHA Enterprise (paid, no quota) for web, generate tokens client side and verify token via Node.js Admin SDK on the backend, set default TTL 1 hour with automatic refresh at half TTL, and deploy an Apigee RS-256 policy that blocks curl calls while allowing app traffic.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:17Firebase Security
- 0:50What is App Check
- 1:39New Attestation Providers
- 2:03New services protected by App Check
- 3:24Demo: Setting up Attestation providers - iOS - App Attest
- 4:53Demo: Setting up Attestation providers - web - reCAPTCHA
- 5:27Setting TTL
- 7:20Enforcing Firestore
- 7:38App Check + Custom Backend Resources
- 8:35Demo: Setting up Custom Backend Attestation - Backend Service
- 9:31Demo: Setting up Custom Backend Attestation - Android
- 10:06Demo: Setting up Custom Backend Attestation - iOS
- 10:24Demo: Setting up Custom Backend Attestation - Web
- 10:40App Check + Apigee
- 11:26Demo: Setting up Apigee
- 12:44Wrap-up
related talks
13mVerifying app identity with App Check
09mProtecting APIs with DeviceCheck, App Attest & WebAuthn
23mWhy an SDK is Needed to Protect APIs from Mobile Apps
39mAndroid App Security Fundamentals
25mFive tips to secure your app
40mThree New Ways to Secure Your App with Firebase Authentication
01h 02mApisecure, 14 & 15 March 2023 - Ted Miracco, CEO at Approov & Attestation.
28mApp Security Essentials