🐛 [Firebase_Auth] reCaptcha page pops even though play integrity configured

[lironzemingo]

I have added Firebase auth to my app, configured AppCheck with Play integrity, added SHA-1 in Settings, added my SHA-256 (in Firebase console -> settings, and also under Play Integrity), and also my debug token.
this code runs before runApp :

WidgetsFlutterBinding.ensureInitialized(); await Firebase.initializeApp(); await FirebaseAppCheck.instance.activate( webRecaptchaSiteKey: 'recaptcha-v3-site-key', androidProvider: _isDevEnvironment() ? AndroidProvider.debug : AndroidProvider.playIntegrity, );
I expect not to see the reCaptch page when calling firebaseAuth.verifyPhoneNumber(...)but I still see the reCaptcha screen.
What am I missing? followed every instruction in the documents.

Pubspec:
`name: XXX
description: A new Flutter project.

publish_to: 'none' # Remove this line if you wish to publish to pub.dev
version: 0.1.0+1

environment:
sdk: '>=2.19.2 <3.0.0'

dependencies:
flutter:
sdk: flutter

bloc: ^8.1.1
cached_network_image: ^3.2.3
country_calling_code_picker: ^2.0.1
crop_your_image: ^0.7.4
cupertino_icons: ^1.0.5
device_info_plus: ^8.1.0
dio: ^5.0.0
equatable: ^2.0.5
fimber: ^0.6.6
firebase_app_check: ^0.1.1+13
firebase_auth: ^4.2.7
firebase_core: ^2.6.0
firebase_crashlytics: ^3.0.15
firebase_performance: ^0.9.0+14
flutter_bloc: ^8.1.2
flutter_contacts: ^1.1.6
flutter_easyloading: ^3.0.5
flutter_flavor: ^3.1.1
flutter_keyboard_visibility: ^5.4.0
flutter_native_splash: ^2.2.18
flutter_secure_storage: ^8.0.0
flutter_svg: ^2.0.2
get_it: ^7.2.0
go_router: ^6.0.6
google_fonts: ^4.0.3
http_parser: ^4.0.2
image: ^4.0.15
image_picker: ^0.8.6+3
json_annotation: ^4.8.0
just_the_tooltip: ^0.0.12
path_provider: ^2.0.13
permission_handler: ^10.2.0
pinput: ^2.2.31
retrofit: ^4.0.1
get: ^4.6.5
share_plus: ^6.3.1
tap_debouncer: ^2.0.2
url_launcher: ^6.1.10

webview_flutter: ^4.0.5

dev_dependencies:
flutter_test:
sdk: flutter

build_runner: ^2.3.3
flutter_gen_runner: ^5.2.0
flutter_lints: ^2.0.1
json_serializable: ^6.6.1
retrofit_generator: ^5.0.0

flutter_native_splash:
color: '#000000'

image: assets/images/logo_native_splash_4x.png

flutter_gen:
output: lib/core/gen

integrations:
flutter_svg: true

flutter:

uses-material-design: true

assets:
- assets/images/
- assets/icons/
`
Flutter doctor:

[!] Flutter (Channel stable, 3.7.3, on macOS 12.6 21G115 darwin-arm64, locale en-IL)
• Flutter version 3.7.3 on channel stable at /Users/lironitzhaki/flutter
! Warning: dart on your path resolves to /usr/local/Cellar/dart/2.19.3/libexec/bin/dart, which is not inside your current Flutter SDK checkout at /Users/lironitzhaki/flutter. Consider adding /Users/lironitzhaki/flutter/bin to the front of your path.
• Upstream repository https://github.com/flutter/flutter.git
• Framework revision 9944297138 (5 weeks ago), 2023-02-08 15:46:04 -0800
• Engine revision 248290d6d5
• Dart version 2.19.2
• DevTools version 2.20.1
• If those were intentional, you can disregard the above warnings; however it is recommended to use "git" directly to perform update checks and upgrades.

[✓] Android toolchain - develop for Android devices (Android SDK version 32.1.0-rc1)
• Android SDK at /Users/lironitzhaki/Library/Android/sdk
• Platform android-33, build-tools 32.1.0-rc1
• Java binary at: /Applications/Android Studio.app/Contents/jre/Contents/Home/bin/java
• Java version OpenJDK Runtime Environment (build 11.0.13+0-b1751.21-8125866)
• All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 14.2)
• Xcode at /Applications/Xcode.app/Contents/Developer
• Build 14C18
• CocoaPods version 1.11.3

[✓] Chrome - develop for the web
• Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2021.3)
• Android Studio at /Applications/Android Studio.app/Contents
• Flutter plugin can be installed from:
🔨 https://plugins.jetbrains.com/plugin/9212-flutter
• Dart plugin can be installed from:
🔨 https://plugins.jetbrains.com/plugin/6351-dart
• Java version OpenJDK Runtime Environment (build 11.0.13+0-b1751.21-8125866)

[✓] Connected device (3 available)
• SM S908E (mobile) • R5CT3493C5J • android-arm64 • Android 13 (API 33)
• macOS (desktop) • macos • darwin-arm64 • macOS 12.6 21G115 darwin-arm64
• Chrome (web) • chrome • web-javascript • Google Chrome 110.0.5481.177

[✓] HTTP Host Availability
• All required HTTP hosts are available

! Doctor found issues in 1 category.

[darshankawar]

@lironzemingo
The default method is captcha so if you are using SMS auth, the captcha will be shown. The play integrity or app_check is not default. Since you already have SHAs already configured, the app will be using this setting and hence the captcha might be showing up.

In order to narrow down this behavior to only firebase_auth and play integrity (app_check), can you trim down this use case without any third party package implementation ? or just try to see if recaptcha is still shown only using barebone sample project ?

[lironzemingo]

@darshankawar thank you for your reply.
I've created a project with only these dependencies:
firebase_app_check: ^0.1.1+13
firebase_auth: ^4.2.7
firebase_core: ^2.6.0

with the same applicationId and same google-services.json
still, when calling firebaseAuth.verifyPhoneNumber(...), reCaptcha page appears.
any thoughts?

[darshankawar]

I expect not to see the reCaptch page when calling firebaseAuth.verifyPhoneNumber(...)but I still see the reCaptcha screen.

@lironzemingo Curious to know as why recaptcha should not be shown ? Since you are trying to authenticate the phone number by using SMS, the recaptcha will be shown if I am not wrong.

[lironzemingo]

@darshankawar
in any of the apps that use OTP I've never been displayed with this page. maybe they don't use Firebase...
anyway, it says in the docs that this can be avoided by using AppCheck, so I expect this to work. or maybe I misunderstood the purpose of AppCheck