監控 App Check 要求指標
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
在應用程式中加入 App Check SDK 後,啟用 App Check 強制執行功能前,請先確認這麼做不會干擾現有的合法使用者。
您可以使用 App Check 要求指標畫面,為 Firebase AI Logic、Data Connect、Realtime Database、Cloud Firestore、Cloud Storage、Authentication、適用於 iOS 的 Google 帳戶登入、Maps JavaScript API 和 Places API (新版) 做出這項決定。
如要查看產品的 App Check 要求指標,請開啟App Check 控制台的 Firebase 區段。例如:

各產品的要求指標可細分為四個類別:
「已驗證」要求是指具備有效 App Check 權杖的要求。啟用 App Check 強制執行後,只有這類要求才會成功。
過時的用戶端要求是指缺少 App Check 權杖的要求。這些要求可能來自舊版 Firebase SDK,也就是應用程式採用 App Check 前的版本。
來源不明的要求缺少 App Check 權杖,且看起來不像是來自 Firebase SDK。這些要求可能是使用遭竊的 API 金鑰所發出,也可能是未透過 Firebase SDK 發出的偽造要求。
無效要求是指含有無效 App Check 權杖的要求,可能來自試圖冒用您應用程式的偽造用戶端,或是來自模擬環境。
應用程式的這些類別分布情況,應做為您決定是否啟用強制執行的依據。以下提供部分準則:
如果近期幾乎所有要求都來自已驗證的用戶端,建議啟用強制執行功能,開始保護後端資源。
如果近期有大量要求來自可能過時的用戶端,為避免影響使用者,建議您等待更多使用者更新應用程式,再啟用強制執行。對已發布的應用程式強制執行 App Check,會導致未整合 App Check SDK 的舊版應用程式無法運作。
如果應用程式尚未發布,您應立即啟用App Check強制執行
,因為目前沒有任何過時的用戶端正在使用。
後續步驟
瞭解 App Check 對使用者的影響,並準備好繼續後,即可啟用 App Check 強制執行 Firebase AI Logic、Data Connect、Realtime Database、Cloud Firestore、Cloud Storage、Authentication、適用於 iOS 的 Google Identity、Maps JavaScript API 和 Places API (新版)。
除非另有註明,否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權,程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間:2025-08-23 (世界標準時間)。
[null,null,["上次更新時間:2025-08-23 (世界標準時間)。"],[],[],null,["After you add the App Check SDK to your app, but before you enable\nApp Check enforcement, you should make sure that doing so won't disrupt your\nexisting legitimate users.\n\nAn important tool you can use to make this decision for\nFirebase AI Logic, Data Connect, Realtime Database, Cloud Firestore, Cloud Storage, Authentication, Google Identity for iOS, Maps JavaScript API, and Places API (New) is the App Check request metrics screen.\n\nTo view the App Check request metrics for a product, open the\n[**App Check**](//console.firebase.google.com/project/_/appcheck) section of the\nFirebase console. For example:\n\nThe request metrics for each product are broken down into four categories:\n\n- **Verified** requests are those that have a valid App Check token. After\n you enable App Check enforcement, only requests in this category will\n succeed.\n\n- **Outdated client** requests are those that are missing an App Check\n token. These requests might be from an older version of the Firebase SDK\n before App Check was included in the app.\n\n- **Unknown origin** requests are those that are missing an App Check token,\n and don't look like they come from the Firebase SDK. These might be from\n requests made with stolen API keys or forged requests made without the\n Firebase SDK.\n\n- **Invalid** requests are those that have an invalid\n App Check token, which might be from an inauthentic client attempting to\n impersonate your app, or from emulated environments.\n\nThe distribution of these categories for your app should inform when you decide\nto enable enforcement. Here are some guidelines:\n\n- If almost all of the recent requests are from verified clients, consider\n enabling enforcement to start protecting your backend resources.\n\n- If a significant portion of the recent requests are from likely-outdated\n clients, to avoid disrupting users, consider waiting for more users to update\n your app before enabling enforcement. Enforcing App Check on a released\n app will break prior app versions that are not integrated with the\n App Check SDK.\n\n- If your app hasn't launched yet, you should enable App Check enforcement\n immediately, since there aren't any outdated clients in use.\n\nNext steps\n\nWhen you understand how App Check will affect your users and you're ready to\nproceed, you can [enable App Check enforcement](/docs/app-check/enable-enforcement)\nfor Firebase AI Logic, Data Connect, Realtime Database, Cloud Firestore, Cloud Storage, Authentication, Google Identity for iOS, Maps JavaScript API, and Places API (New)."]]