Operating System

macOS Sonoma 14.5

Environment (if applicable)

Chrome

Firebase SDK Version

10.14.1

Firebase SDK Product(s)

AppCheck

Project Tooling

React app with Webpack and jest

Detailed Problem Description

What I was trying to achieve

I expected getToken(appCheckInstance, { forceRefresh: true }) to return a fresh App Check token or throw an error if the request failed (e.g., due to network issues or misconfiguration). This would allow proper error handling in my application.

What actually happened

When an error occurs, getToken does not return or throw it. Instead, it silently returns the cached token (if a valid one exists), making failures undetectable programmatically.

Unexpected behavior

• Errors are logged internally in the console but not surfaced to the caller.
• This prevents proper error handling, as failures cannot be detected in code.
• This causes the third-party caller to receive the cached token without realizing that it is not the fresh token they requested, but instead the cached one.

Code Reference:

In the getToken function, when an error occurs and forceRefresh is true, if a valid cached token exists, the error is assigned to the internalError property of the token result object. However, this internalError is never surfaced to the caller, and the function silently returns the cached token instead of propagating the error. This appears to be an oversight in handling the forceRefresh case, specifically in error scenarios:

Relevant logs / Console output (observed in DevTools Console)

No Network Scenario:

[2025-02-26T00:26:51.162Z]  @firebase/app-check: FirebaseError: AppCheck: ReCAPTCHA error. (appCheck/recaptcha-error).

Despite this logged error, getToken still returns the last cached token instead of failing.

Invalid ReCAPTCHA Site Key Scenario

When testing an incorrect ReCAPTCHA site key, the following message appeared in the console:

@firebase/app-check: AppCheck: Requests throttled due to 403 error. Attempts allowed again after 01d:00m:00s (appCheck/throttled).

Again, the error is logged internally but not returned to the caller, preventing proper handling of any errors.

Expected behavior

Errors should be returned or thrown instead of being logged silently. If throwing the error is not the preferred approach, I would suggest returning the error alongside the token to the third-party caller. This would provide the app with the necessary information to properly detect and handle the failure, ensuring that it is not silently overlooked.

Steps and code to reproduce issue

1. Initialize Firebase App Check.
2. Call getToken(appCheckInstance, { forceRefresh: true }).
3. Simulate any error getting token such as network issue or invalid App Check configuration.
4. Observe that the function still returns a cached token instead of throwing an error.