From f28e37fa5ede985afd482c2bf71dbdd464bde61e Mon Sep 17 00:00:00 2001 From: Lahiru Maramba Date: Tue, 22 Sep 2026 22:13:44 +0000 Subject: [PATCH 1/2] fix(fac): Use v1beta endpoint for verifyAppCheckToken Updated _AppCheckService._VERIFY_URL_FORMAT to point to the v1beta endpoint (https://firebaseappcheck.googleapis.com/v1beta/projects/{project_id}:verifyAppCheckToken) for replay protection verification. --- firebase_admin/app_check.py | 2 +- tests/test_app_check.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/firebase_admin/app_check.py b/firebase_admin/app_check.py index 1117e151..7dbd8fe6 100644 --- a/firebase_admin/app_check.py +++ b/firebase_admin/app_check.py @@ -54,7 +54,7 @@ class _AppCheckService: _APP_CHECK_ISSUER = 'https://firebaseappcheck.googleapis.com/' _JWKS_URL = 'https://firebaseappcheck.googleapis.com/v1/jwks' _VERIFY_URL_FORMAT = ( - 'https://firebaseappcheck.googleapis.com/v1/projects/{project_id}:verifyAppCheckToken' + 'https://firebaseappcheck.googleapis.com/v1beta/projects/{project_id}:verifyAppCheckToken' ) _project_id = None _scoped_project_id = None diff --git a/tests/test_app_check.py b/tests/test_app_check.py index b7a7bcd3..27da1d8f 100644 --- a/tests/test_app_check.py +++ b/tests/test_app_check.py @@ -319,7 +319,7 @@ def test_verify_token_with_consume_true_not_consumed(self, mocker): assert payload == expected expected_url = ( - f"https://firebaseappcheck.googleapis.com/v1/projects/{PROJECT_ID}:verifyAppCheckToken" + f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}:verifyAppCheckToken" ) mock_body.assert_called_once_with( "post", expected_url, json={"app_check_token": "encoded"} @@ -340,7 +340,7 @@ def test_verify_token_with_consume_true_already_consumed(self, mocker): assert payload == expected expected_url = ( - f"https://firebaseappcheck.googleapis.com/v1/projects/{PROJECT_ID}:verifyAppCheckToken" + f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}:verifyAppCheckToken" ) mock_body.assert_called_once_with( "post", expected_url, json={"app_check_token": "encoded"} From b2733ee69d7d632735c13cdca5e7c8de5bce50f8 Mon Sep 17 00:00:00 2001 From: Lahiru Maramba Date: Tue, 22 Sep 2026 22:34:21 +0000 Subject: [PATCH 2/2] chore(fac): Fix line length lint in test_app_check.py --- tests/test_app_check.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/test_app_check.py b/tests/test_app_check.py index 27da1d8f..b88d1d6a 100644 --- a/tests/test_app_check.py +++ b/tests/test_app_check.py @@ -319,7 +319,8 @@ def test_verify_token_with_consume_true_not_consumed(self, mocker): assert payload == expected expected_url = ( - f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}:verifyAppCheckToken" + f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}" + ":verifyAppCheckToken" ) mock_body.assert_called_once_with( "post", expected_url, json={"app_check_token": "encoded"} @@ -340,7 +341,8 @@ def test_verify_token_with_consume_true_already_consumed(self, mocker): assert payload == expected expected_url = ( - f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}:verifyAppCheckToken" + f"https://firebaseappcheck.googleapis.com/v1beta/projects/{PROJECT_ID}" + ":verifyAppCheckToken" ) mock_body.assert_called_once_with( "post", expected_url, json={"app_check_token": "encoded"}