Custom provider getToken() creates infinite loop when device time is tempered

[im12345dev]

[READ] Step 1: Are you in the right place?

Issues filed here should be about bugs in the code in this repository.
If you have a general question, need help debugging, or fall into some
other category use one of these other channels:

• For general technical questions, post a question on StackOverflow
  with the firebase tag.
• For general Firebase discussion, use the firebase-talk
  google group.
• For help troubleshooting your application that does not fall under one
  of the above categories, reach out to the personalized
  Firebase support channel.

[REQUIRED] Step 2: Describe your environment

• Android Studio version: Chipmunk 2021.2.1
• Firebase Component: App Check
• Component version: bom 30.2.0

[REQUIRED] Step 3: Describe the problem

I have implemented a custom provider using Firebase Functions and the firebase-admin sdk which return a token and expiration time using some custom logic, the implementation works perfectly when the time on the device is correct and not tempered with, but as soon as the time on the device is being tempered, for example a user set the clock to +2 hours using the device settings, Android App Check SDK gets into infinite loop as the token expiration time from the server is current time + 60 minutes but the device time is current time + 2 hours (due to settings change), which leads to the SDK to think the token is expired and start an infinite refresh loop

Steps to reproduce:

Configuring a token TTL to 60 minutes and changing the device clock to +1 hour should reproduce it

Relevant Code:

`public class YourCustomAppCheckProvider implements AppCheckProvider {

private final Context applicationContext;

public YourCustomAppCheckProvider(Context applicationContext) {
    this.applicationContext = applicationContext;
}

@Override
public Task<AppCheckToken> getToken() {

    TaskCompletionSource<AppCheckToken> taskCompletionSource = new TaskCompletionSource<>();

    try {
        String token = customLogicToGetToken()
        int expirationFromServer = expiration received from the server endpoint...

        long expMillis = expirationFromServer * 1000L - 60000;

        taskCompletionSource.setResult(new CustomAppCheckToken(token,expMillis));
    } catch (IOException | JSONException e) {
        taskCompletionSource.setException(e);
    }

    return taskCompletionSource.getTask();
}

}
`

The Firebase function to generate the token + expiration time:

`

exports.fetchAppCheckToken = functions.https.onCall((authenticityData, context) => {

//Custom logic to decide if the request is valid or not, in case not return "error"...


    return admin.appCheck().createToken(APP ID)
        .then(function (appCheckToken) {
            const expiresAt = Math.floor(Date.now() / 1000) + 60 * 60;

            return {token: appCheckToken.token, expiresAt: expiresAt, ttlMillis: appCheckToken.ttlMillis}
        })
        .catch(function (err) {
            console.error("Unable to create App Check token.");
            console.error(err);

            return "error"
        });
});

Now of course I can just check if the "expiresAt" received from the function is smaller than System.currentTimeInMills() and then return exception in the getToken() method, but that means any user who changed his device time in settings wont be able to user my app.
Is it a bug or just something I am doing wrong?

[im12345dev]

Hey @rizafran, did you manage to replicate it? it should be quite straight forward

[argzdev]

Hi @im12345dev, thanks for reporting. Sorry for the delayed response here. I tried testing this scenario using SafetyNet and it seems to work fine. I'm guessing this use case should also work when using a custom provider since the behavior for this scenario should be the same. Let me notify and consult our engineering team and see what we can do here. Thanks!

[im12345dev]

@argzdev I can replicate the issue on multiple devices using custom provider, the issue is coming from using System.currentTimeInMills() in the expire check, when you change the device time to +1 hour the System.currentTimeInMills() will change as well to +1 hour, causing the token to be expire immediately as the expire time is time in mills received from the server rather the device.

Also, isn't SafetyNet based on Play Services?

[argzdev]

Hi @im12345dev, yes, SafetyNet is based on Play Services. Sorry for the misunderstanding, what I'm trying to say is that if this type of use case works for SafetyNet, then I think we should also be supporting this in the custom provider setup as well.

I've raised this up to our engineering team, however while waiting for a response, could you provide more details on how you retrieve your getToken, specifically on the customLogicToGetToken() and expirationFromServer? I'm assuming this is when you call Firebase Functions. Can you share a bit more code regarding this? But of course, feel free to redact any PII or details you don't want to share. Other than that, this'll help us a lot.

Also if you could share a MCVE, that'll speed up our investigation even faster. Thanks!

Relevant code:

@Override
public Task<AppCheckToken> getToken() {

    TaskCompletionSource<AppCheckToken> taskCompletionSource = new TaskCompletionSource<>();

    try {
        String token = customLogicToGetToken()
        int expirationFromServer = expiration received from the server endpoint...

        long expMillis = expirationFromServer * 1000L - 60000;

        taskCompletionSource.setResult(new CustomAppCheckToken(token,expMillis));
    } catch (IOException | JSONException e) {
        taskCompletionSource.setException(e);
    }

    return taskCompletionSource.getTask();
}

[im12345dev]

Below is the getToken() code that I use to retrieve the token from the Firebase Function:

    @Override
    public Task<AppCheckToken> getToken() {

        Retrofit retrofit = new Retrofit.Builder()
        .baseUrl("https://{project-id}.cloudfunctions.net")
        .addConverterFactory(GsonConverterFactory.create())
        .build();
        MainActivity.APIService retroService = retrofit.create(MainActivity.APIService.class);

        Call<ResponseBody> call = retroService.appToken();
        TaskCompletionSource<AppCheckToken> taskCompletionSource = new TaskCompletionSource<>();

        try {
            JSONObject jsonObject = new JSONObject(call.execute().body().string());
            String token = jsonObject.getJSONObject("result").getString("token");
            int expirationFromServer = jsonObject.getJSONObject("result").getInt("expiresAt");
            long expMillis = expirationFromServer * 1000L - 60000;

            taskCompletionSource.setResult(new CustomAppCheckToken(token,expMillis));
        } catch (IOException | JSONException e) {
            taskCompletionSource.setException(e);
        }

        return taskCompletionSource.getTask();
    }

This is the Firebase Functions I use to generate the token and send the information back to the client:

exports.fetchAppCheckToken = functions.https.onCall((authenticityData, context) => {
    console.log('authenticityData: '+JSON.stringify(authenticityData))

    return admin.appCheck().createToken('{app-id}')
        .then(function (appCheckToken) {
            // Token expires in an hour.
            const expiresAt = Math.floor(Date.now() / 1000) + 60 * 60;
            console.log('Token: '+JSON.stringify(appCheckToken))
            console.log('expiresAt: '+expiresAt)

            return {token: appCheckToken.token, expiresAt: expiresAt, ttlMillis: appCheckToken.ttlMillis}
        })
        .catch(function (err) {
            console.error('Unable to create App Check token.');
            console.error(err);

            return "error"
        });
});

I am using RetroFit to call the https link of the Firebase Functions and retrieve the data:

1. JSON object containing the token & expire time in milliseconds
2. Error incase something went wrong

The expire time the Firebase Functions sends together with the token is: Math.floor(Date.now() / 1000) + 60 * 60 which is exactly the same as the docs

[argzdev]

Thanks for the extra details, @im12345dev. I'm running into NetworkOnMainThreadException on your code snippet, so I tweaked it a bit. However, I'm still unable to reproduce the same behavior even after adding 1 or 2 hrs to the physical/emulator device time.

Relevant code:

public Task<AppCheckToken> getToken() {
        Retrofit retrofit = new Retrofit.Builder()
                .baseUrl("https://{project-id}.cloudfunctions.net")
                .addConverterFactory(GsonConverterFactory.create())
                .build();
        APIService retroService = retrofit.create(APIService.class);

        Call<ResponseBody> call = null;
        try {
            call = retroService.appToken(new DataRequest(new JSONObject().put("data", null)));
        } catch (JSONException e) {
            e.printStackTrace();
        }

        TaskCompletionSource<AppCheckToken> taskCompletionSource = new TaskCompletionSource<>();

        call.enqueue(new Callback<ResponseBody>() {
            @Override
            public void onResponse(Call<okhttp3.ResponseBody> call, Response<ResponseBody> response) {
                try {
                    JSONObject jsonObject = new JSONObject(response.body().string());
                    String token = jsonObject.getJSONObject("result").getString("token");
                    int expirationFromServer = jsonObject.getJSONObject("result").getInt("expiresAt");
                    long expMillis = expirationFromServer * 1000L - 60000;

                    Log.d(TAG, "onResponse: " + response.body().string());

                    taskCompletionSource.setResult(new YourCustomAppCheckToken(token,expMillis));
                } catch (IOException | JSONException e) {
                    e.printStackTrace();
                }
            }

            @Override
            public void onFailure(Call<ResponseBody> call, Throwable t) {
                Log.d(TAG, "onFailure: " + t.getMessage());
            }
        });

        return taskCompletionSource.getTask();
    }

To test this, I called this via a button click:

private void retrieveTokenAuto(){
        firebaseAppCheck.getToken(true).addOnCompleteListener(task -> {
            if(task.isSuccessful()){
                String token = task.getResult().getToken();
                Log.d(TAG, "token received: " + token);
            } else {
                Log.d(TAG, "token retrieval failed: ");
            }
        });
    }

Am I missing anything?

[im12345dev]

@argzdev Using the exact same code you posted I was able to replicate it, it goes into infinite loop of renewing the token.
Can you post the Firebase Function you used in order to generate the token?

In this video you can see the infinite loop been created, using the same code as yours, I just added 2 hours to the emulator time:
https://user-images.githubusercontent.com/91768057/184416004-f22f86ca-3604-4987-abc0-50256f8723f6.mov

Clicking on the Fab button in the video is starting the retriveTokenAuto() you posted