feat(appcheck): Add App Check token verification support with replay protection - #1233

Open

yvonnep165 wants to merge 22 commits into

mainfrom

yp-verify-appcheck-token

Commits on Aug 20, 2026

Add exception handling covered by standard platform ErrorCode
yvonnep165
committed
4e8c8aa
Add DecodedAppCheckToken, VerifyAppCheckTokenResponse and VerifyAppCheckTokenOptions classes
yvonnep165
committed
7f56cb3

Commits on Aug 21, 2026

Add internal appchecktokenverifier class to support token verification and one time token verification
yvonnep165
committed
4341926
create the entry point for the Firebase App Check service and fix some formatting
yvonnep165
committed
7e4dd47

Commits on Aug 24, 2026

Add unit tests for internal appcheck processing
yvonnep165
committed
8b672ad
add unit tests for decoded app check token
yvonnep165
committed
b015d15
add unit tests for firebaseappcheck class
yvonnep165
committed
c2818a9
add unit tests for appchecktokenoptions
yvonnep165
committed
2cdabc5
add unit tests for appchecktokenresponse
yvonnep165
committed
03e1be1
add defensively check for null for audience claim and wrap the httprequest execute in a try-finally block
yvonnep165
committed
e5269d6

Commits on Aug 25, 2026

add 6-hour caching and default refresh timeout to createKeySource
yvonnep165
committed
3ebfa55
initialize the jwtProcessor inside the constructor and remove getJwtProcessor
yvonnep165
committed
208dbe8
add comment for future issuer check upgrade
yvonnep165
committed
eebd884
reverse error messages for badjoseexception and joseexception
yvonnep165
committed
a737d2b
use java.time.Instant for get issued at time and expiration time
yvonnep165
committed
2c05450
add appid, provider and jti properties exposure
yvonnep165
committed
c30d590
add check for null for setConsume
yvonnep165
committed
8ee2a99

Commits on Aug 26, 2026

remove getappid from decodedappchecktoken
yvonnep165
committed
6d444c1
remove the null case in docstring for getIssuedAt and getExpirationTime
yvonnep165
committed
3e0976e
add tests with real RSA cryptography
yvonnep165
committed
e28273b

Commits on Sep 3, 2026

remove misleading docstring for appchecktokenverifier
yvonnep165
committed
339e395
define app check specific client error codes
yvonnep165
committed
216e197