AppCheck API request error for a few percentage of active users

[Kondamon]

Description

Some of our users get The operation couldn’t be completed. API request error.when using AppCheck. The issue is not reproducible on our side. See also #12468 (comment).

Reproducing the issue

 AppCheck.appCheck().token(forcingRefresh: false) { [weak self] token, error in
 ...
// error
 }

Error: The operation couldn’t be completed. API request error.

Firebase SDK Version

11.3.0

Xcode Version

15.4 (15F31d)

Installation Method

Swift Package Manager

Firebase Product(s)

Analytics, App Check, Crashlytics

Targeted Platforms

iOS

Relevant Log Output

The operation couldn’t be completed. API request error.

If using Swift Package Manager, the project's Package.resolved

AppCheckCore 11.1.0

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[Kondamon]

@ncooke3

[ncooke3]

Thanks, @Kondamon. Could you share your project number with me? Feel free to email it to: nickcooke+gh at google dot com

The SDK is labeling this as a generic network error so I'm hoping that the backend logs associated with the project number may provide more details.

[ncooke3]

Hi @Kondamon, I just released AppCheckCore 11.2.0 which is compatible with the latest Firebase 11.x versions. You can pull it in by updating your SPM dependencies. The errors you shared traced back to reusing expired app attest challenges. Since these challenges are not stored anywhere, the hypothesis is that URLSession's caching protocol may be giving back requested challenges rather than fetching new ones from the server–– leading to the reuse of expired challenges.

I'm going to mark this issue as fixed now, but we can re-open it if needed.

[Kondamon]

@ncooke3 Unfortunately, AppCheckCore 11.2.0 didn't resolve the issue. I'm still getting the same error message.

[ncooke3]

Thanks for checking, @Kondamon. This time, were you able to reproduce the error locally or were these reported from your released app?

[Kondamon]

@ncooke3, no, I'm not able to reproduce it locally. We have received the error in Crashlytics for our latest release.

[Kondamon]

@ncooke3, I can reproduce this error now, when there is no internet connection. It seems that Crashlytics is caching the errors in this case and logging them the next time the user is online!