🐛 [APP_CHECK] Not working on Web in release mode

[arisAlexis]

Bug report

Describe the bug
Recaptcha config with secret and public key configured, not working. Key and domains are correct on google recaptcha enterprise v3 and correctly configured both on firebase console and in my app. It results in error 400 when loading resource to validate key (error below).

Failed to load resource with status 400:

https://content-firebaseappcheck.googleapis.com/v1/projects/lala-60d92/apps/1:800367749055:web:ea6fcbcc19d31e9a5ca30a:exchangeRecaptchaV3Token?key=XXX

They key displayed is not the one configured on the firebase console. How can this be?

Steps to reproduce

Steps to reproduce the behavior:

1. Go to '...'
2. '...'
3. See error or incorrect behavior

Expected behavior

Recaptcha working

Sample project

Providing a minimal example project which demonstrates the bug in isolation from your main App greatly enhances the chance of a timely fix.
Please link to the public repository URL.

await FirebaseAppCheck.instance.activate(
      webRecaptchaSiteKey: XXX, (key is correct, double checked and same as in console)
      androidProvider:
          kDebugMode ? AndroidProvider.debug : AndroidProvider.playIntegrity);

---

Additional context

Configured recaptcha v3 enterprise shows this error on chrome console:
Failed to load resource with status 400:

https://content-firebaseappcheck.googleapis.com/v1/projects/risa-60d92/apps/1:800367749055:web:ea6fcbcc19d31e9a5ca30a:exchangeRecaptchaV3Token?key=XXX

note that this key is not what is on my firebase console, not sure if it's supposed to be like that or not.

---

Flutter doctor

Run flutter doctor and paste the output below:

Click To Expand

Doctor summary (to see all details, run flutter doctor -v):
[√] Flutter (Channel stable, 3.10.0, on Microsoft Windows [Version 10.0.22621.1702], locale en-US)
[√] Windows Version (Installed version of Windows is version 10 or higher)
[√] Android toolchain - develop for Android devices (Android SDK version 33.0.2)
[√] Chrome - develop for the web
[√] Visual Studio - develop for Windows (Visual Studio Build Tools 2022 17.5.4)
[√] Android Studio (version 2022.1)
[√] Android Studio
[√] VS Code (version 1.78.2)
[√] Connected device (3 available)
[√] Network resources

• No issues found!

---

Flutter dependencies

Run flutter pub deps -- --style=compact and paste the output below:

Click To Expand

Dart SDK 3.0.0
Flutter SDK 3.10.0
risa 1.0.0+3

dependencies:
- audioplayers 3.0.1 [audioplayers_android audioplayers_darwin audioplayers_linux audioplayers_platform_interface audioplayers_web audioplayers_windows flutter http path_provider uuid]
- cloud_firestore 4.7.0 [cloud_firestore_platform_interface cloud_firestore_web collection firebase_core firebase_core_platform_interface flutter meta] 
- cloud_functions 4.3.0 [cloud_functions_platform_interface cloud_functions_web firebase_core firebase_core_platform_interface flutter]
- cupertino_icons 1.0.5
- firebase_analytics 10.4.0 [firebase_analytics_platform_interface firebase_analytics_web firebase_core firebase_core_platform_interface flutter]       
- firebase_app_check 0.1.4+1 [firebase_app_check_platform_interface firebase_app_check_web firebase_core firebase_core_platform_interface flutter]      
- firebase_auth 4.6.0 [firebase_auth_platform_interface firebase_auth_web firebase_core firebase_core_platform_interface flutter meta]
- firebase_core 2.13.0 [firebase_core_platform_interface firebase_core_web flutter meta]
- firebase_storage 11.2.0 [firebase_core firebase_core_platform_interface firebase_storage_platform_interface firebase_storage_web flutter]
- flutter 0.0.0 [characters collection js material_color_utilities meta vector_math sky_engine]
- flutter_dotenv 5.0.2 [flutter]
- flutter_easyloading 3.0.5 [flutter flutter_spinkit]
- flutter_facebook_auth 5.0.11 [flutter flutter_facebook_auth_platform_interface flutter_facebook_auth_web facebook_auth_desktop]
- flutter_image_compress 1.1.3 [flutter]
- flutter_login 4.1.1 [another_flushbar another_transformer_page_view flutter font_awesome_flutter provider quiver sign_in_button url_launcher]
- flutter_webrtc 0.9.29+hotfix.1 [collection dart_webrtc flutter js path_provider webrtc_interface]
- font_awesome_flutter 10.4.0 [flutter]
- image_picker 0.8.7+5 [flutter image_picker_android image_picker_for_web image_picker_ios image_picker_platform_interface]
- path_provider 2.0.15 [flutter path_provider_android path_provider_foundation path_provider_linux path_provider_platform_interface path_provider_windows]
- provider 6.0.5 [collection flutter nested]
- rflutter_alert 2.0.4 [flutter]
- shared_preferences 2.1.1 [flutter shared_preferences_android shared_preferences_foundation shared_preferences_linux shared_preferences_platform_interface shared_preferences_web shared_preferences_windows]
- url_launcher 6.1.11 [flutter url_launcher_android url_launcher_ios url_launcher_linux url_launcher_macos url_launcher_platform_interface url_launcher_web url_launcher_windows]
- uuid 3.0.7 [crypto]
- web_socket_channel 2.4.0 [async crypto stream_channel]

dev dependencies:
- flutter_lints 2.0.1 [lints]
- flutter_test 0.0.0 [flutter test_api path fake_async clock stack_trace vector_math async boolean_selector characters collection js matcher material_color_utilities meta source_span stream_channel string_scanner term_glyph]

transitive dependencies:
- _flutterfire_internals 1.3.1 [collection firebase_core firebase_core_platform_interface flutter meta]
- another_flushbar 1.12.30 [flutter]
- another_transformer_page_view 2.0.1 [flutter]
- async 2.11.0 [collection meta]
- audioplayers_android 2.0.0 [audioplayers_platform_interface flutter]
- audioplayers_darwin 3.0.1 [audioplayers_platform_interface flutter]
- audioplayers_linux 1.0.4 [audioplayers_platform_interface flutter]
- audioplayers_platform_interface 4.0.0 [flutter plugin_platform_interface]
- audioplayers_web 2.2.0 [audioplayers_platform_interface flutter flutter_web_plugins js]
- audioplayers_windows 1.1.3 [audioplayers_platform_interface flutter]
- boolean_selector 2.1.1 [source_span string_scanner]
- characters 1.3.0
- clock 1.1.1
- cloud_firestore_platform_interface 5.14.0 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- cloud_firestore_web 3.5.0 [_flutterfire_internals cloud_firestore_platform_interface collection firebase_core firebase_core_web flutter flutter_web_plugins js]
- cloud_functions_platform_interface 5.4.0 [firebase_core flutter meta plugin_platform_interface]
- cloud_functions_web 4.5.0 [cloud_functions_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins js]
- collection 1.17.1
- cross_file 0.3.3+4 [js meta]
- crypto 3.0.3 [typed_data]
- dart_webrtc 1.0.16 [js platform_detect webrtc_interface]
- facebook_auth_desktop 0.0.9 [flutter http flutter_secure_storage flutter_facebook_auth_platform_interface]
- fake_async 1.3.1 [clock collection]
- ffi 2.0.2
- file 6.1.4 [meta path]
- firebase_analytics_platform_interface 3.6.0 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_analytics_web 0.5.4 [_flutterfire_internals firebase_analytics_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins js]
- firebase_app_check_platform_interface 0.0.8+1 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_app_check_web 0.0.10+1 [_flutterfire_internals firebase_app_check_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins js]
- firebase_auth_platform_interface 6.15.0 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- firebase_auth_web 5.5.0 [firebase_auth_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins http_parser js meta]
- firebase_core_platform_interface 4.8.0 [collection flutter flutter_test meta plugin_platform_interface]
- firebase_core_web 2.5.0 [firebase_core_platform_interface flutter flutter_web_plugins js meta]
- firebase_storage_platform_interface 4.4.0 [collection firebase_core flutter meta plugin_platform_interface]
- firebase_storage_web 3.6.0 [_flutterfire_internals async firebase_core firebase_core_web firebase_storage_platform_interface flutter flutter_web_plugins http js meta]
- flutter_facebook_auth_platform_interface 4.1.1 [flutter plugin_platform_interface]
- flutter_facebook_auth_web 4.1.1 [flutter flutter_web_plugins js flutter_facebook_auth_platform_interface]
- flutter_plugin_android_lifecycle 2.0.14 [flutter]
- flutter_secure_storage 8.0.0 [flutter flutter_secure_storage_linux flutter_secure_storage_macos flutter_secure_storage_platform_interface flutter_secure_storage_web flutter_secure_storage_windows meta]
- flutter_secure_storage_linux 1.1.3 [flutter flutter_secure_storage_platform_interface]
- flutter_secure_storage_macos 3.0.0 [flutter flutter_secure_storage_platform_interface]
- flutter_secure_storage_platform_interface 1.0.1 [flutter plugin_platform_interface]
- flutter_secure_storage_web 1.1.1 [flutter flutter_secure_storage_platform_interface flutter_web_plugins js]
- flutter_secure_storage_windows 2.0.0 [flutter flutter_secure_storage_platform_interface]
- flutter_spinkit 5.2.0 [flutter]
- flutter_web_plugins 0.0.0 [flutter js characters collection material_color_utilities meta vector_math]
- http 0.13.6 [async http_parser meta]
- http_parser 4.0.2 [collection source_span string_scanner typed_data]
- image_picker_android 0.8.6+14 [flutter flutter_plugin_android_lifecycle image_picker_platform_interface]
- image_picker_for_web 2.1.12 [flutter flutter_web_plugins image_picker_platform_interface]
- image_picker_ios 0.8.7+4 [flutter image_picker_platform_interface]
- image_picker_platform_interface 2.6.3 [cross_file flutter http plugin_platform_interface]
- js 0.6.7 [meta]
- lints 2.1.0
- matcher 0.12.15 [async meta stack_trace term_glyph test_api]
- material_color_utilities 0.2.0
- meta 1.9.1
- nested 1.0.0 [flutter]
- path 1.8.3
- path_provider_android 2.0.27 [flutter path_provider_platform_interface]
- path_provider_foundation 2.2.3 [flutter path_provider_platform_interface]
- path_provider_linux 2.1.10 [ffi flutter path path_provider_platform_interface xdg_directories]
- path_provider_platform_interface 2.0.6 [flutter platform plugin_platform_interface]
- path_provider_windows 2.1.6 [ffi flutter path path_provider_platform_interface win32]
- platform 3.1.0
- platform_detect 2.0.7 [meta pub_semver]
- plugin_platform_interface 2.1.4 [meta]
- process 4.2.4 [file path platform]
- pub_semver 2.1.4 [collection meta]
- quiver 3.2.1 [matcher]
- shared_preferences_android 2.1.4 [flutter shared_preferences_platform_interface]
- shared_preferences_foundation 2.2.2 [flutter shared_preferences_platform_interface]
- shared_preferences_linux 2.2.0 [file flutter path path_provider_linux path_provider_platform_interface shared_preferences_platform_interface]
- shared_preferences_platform_interface 2.2.0 [flutter plugin_platform_interface]
- shared_preferences_web 2.1.0 [flutter flutter_web_plugins shared_preferences_platform_interface]
- shared_preferences_windows 2.2.0 [file flutter path path_provider_platform_interface path_provider_windows shared_preferences_platform_interface]     
- sign_in_button 3.2.0 [flutter font_awesome_flutter]
- sky_engine 0.0.99
- source_span 1.9.1 [collection path term_glyph]
- stack_trace 1.11.0 [path]
- stream_channel 2.1.1 [async]
- string_scanner 1.2.0 [source_span]
- term_glyph 1.2.1
- test_api 0.5.1 [async boolean_selector collection meta source_span stack_trace stream_channel string_scanner term_glyph matcher]
- typed_data 1.3.2 [collection]
- url_launcher_android 6.0.33 [flutter url_launcher_platform_interface]
- url_launcher_ios 6.1.4 [flutter url_launcher_platform_interface]
- url_launcher_linux 3.0.5 [flutter url_launcher_platform_interface]
- url_launcher_macos 3.0.5 [flutter url_launcher_platform_interface]
- url_launcher_platform_interface 2.1.2 [flutter plugin_platform_interface]
- url_launcher_web 2.0.16 [flutter flutter_web_plugins url_launcher_platform_interface]
- url_launcher_windows 3.0.6 [flutter url_launcher_platform_interface]
- vector_math 2.1.4
- webrtc_interface 1.0.13
- win32 4.1.4 [ffi]
- xdg_directories 1.0.0 [meta path process]

---

[danagbemava-nc]

Hi @arisAlexis, what is the configuration of the TTL on your firebase console? Can you also check https://firebase.google.com/docs/app-check/flutter/debug-provider#web to see if it helps?

[arisAlexis]

Hi, I do not want a debug provider, it works ok with the debug token. I want production code with recaptcha. The TTL is set to the default 1h and it doesn't matter because it never worked even after days, redeployments and all.

The error response is:

{
  "error": {
    "code": 400,
    "message": "App not registered: 1:800367749055:web:ea6fcbcc19d31e9a5ca30a.",
    "status": "FAILED_PRECONDITION"
  }
}

but the app IS registered with recaptcha on the firebase console.

[danagbemava-nc]

Hi @arisAlexis, can you walk me through the steps you used to setup your project so that I can try to reproduce?

[arisAlexis]

Hi sure.

1. Firebase app in console.
2. Recaptcha entreprise with configured 3 domains. the app.firebaseapp.com, the app.web.app and the real domain name.
3. Recaptcha secret in firebase console under recaptcha entreprise.
4. Firebase app check tab , app says registered
5. Code initialized with: await FirebaseAppCheck.instance.activate(

6.   webRecaptchaSiteKey: dotenv.env["RECAPTCHA_KEY"] and this var is also printed on the console and it's correct. It's the "site key" from the recaptcha configuration mentioned above.
   

7. Fibase console -> project settings -> web -> configuration matches the firebase.options file in my flutter folder.

What else?

[danagbemava-nc]

Thanks for the steps. I see a similar issue when I use the steps outlined and the firebase_app_check code sample.

{
  "error": {
    "code": 400,
    "message": "App not registered: 1:949478422196:web:0e66b7f248c2c36302c9e1.",
    "status": "FAILED_PRECONDITION"
  }
}

I'm not sure if there are some other steps needed to set it up. Labeling for further insight from the team