Menggunakan App Check dengan penyedia debug di aplikasi web
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Jika Anda telah mendaftarkan aplikasi untuk App Check dan ingin menjalankan aplikasi di lingkungan yang biasanya tidak akan diklasifikasikan sebagai valid oleh App Check, seperti secara lokal selama pengembangan atau dari lingkungan continuous integration (CI), Anda dapat membuat build debug aplikasi yang menggunakan penyedia debug App Check, bukan penyedia pengesahan sungguhan.
Menggunakan penyedia debug di localhost
Untuk menggunakan penyedia debug saat menjalankan aplikasi Anda dari localhost (misalnya, selama pengembangan), lakukan hal berikut:
Dalam build debug, aktifkan mode debug dengan menetapkan self.FIREBASE_APPCHECK_DEBUG_TOKEN ke true sebelum Anda melakukan inisialisasi App Check. Contoh:
self.FIREBASE_APPCHECK_DEBUG_TOKEN=true;firebase.appCheck().activate(/* site key or provider */);
Buka aplikasi web Anda secara lokal, lalu buka alat developer browser. Di konsol debug, Anda akan melihat token debug:
AppCheck debug token: "123a4567-b89c-12d3-e456-789012345678". You will
need to safelist it in the Firebase console for it to work.
Di bagian App Check pada Firebase console, pilih Manage debug tokens dari menu tambahan aplikasi. Kemudian daftarkan token debug yang Anda catat dalam log di langkah sebelumnya.
Setelah Anda mendaftarkan token, layanan backend Firebase akan menerimanya sebagai valid.
Karena token ini memungkinkan akses ke resource Firebase Anda tanpa perangkat yang valid, Anda harus menjaga kerahasiaannya. Jangan meng-commit token ke repositori publik, dan jika token yang terdaftar pernah terungkap kerahasiaannya, segera cabut token tersebut di Firebase console.
Token ini disimpan secara lokal di browser dan akan digunakan setiap kali Anda menggunakan aplikasi di browser yang sama pada perangkat yang sama. Jika Anda ingin menggunakan token di browser lain atau di mesin lain, tetapkan self.FIREBASE_APPCHECK_DEBUG_TOKEN ke string token, bukan true.
Menggunakan penyedia debug di lingkungan CI
Untuk menggunakan penyedia debug di lingkungan continuous integration (CI), lakukan hal berikut:
Di bagian App Check pada Firebase console, pilih Manage debug tokens dari menu tambahan aplikasi. Kemudian, buat token debug baru. Anda memerlukan token tersebut di langkah berikutnya.
Karena token ini memungkinkan akses ke resource Firebase Anda tanpa perangkat yang valid, Anda harus menjaga kerahasiaannya. Jangan meng-commit token ke repositori publik, dan jika token yang terdaftar pernah terungkap kerahasiaannya, segera cabut token tersebut di Firebase console.
Tambahkan token debug yang baru saja dibuat ke penyimpanan kunci yang aman
di sistem CI Anda (misalnya, rahasia terenkripsi
GitHub Action atau variabel terenkripsi Travis CI).
Jika perlu, konfigurasikan sistem CI Anda untuk menyediakan token debug dalam lingkungan CI sebagai variabel lingkungan. Beri nama variabel, seperti APP_CHECK_DEBUG_TOKEN_FROM_CI.
Dalam build debug, aktifkan mode debug dengan menetapkan self.FIREBASE_APPCHECK_DEBUG_TOKEN ke nilai variabel lingkungan token debug sebelum mengimpor App Check. Contoh:
[null,null,["Terakhir diperbarui pada 2025-08-23 UTC."],[],[],null,["If, after you have registered your app for App Check, you want to run your\napp in an environment that App Check would normally not classify as valid,\nsuch as locally during development, or from a continuous integration (CI)\nenvironment, you can create a debug build of your app that uses the\nApp Check debug provider instead of a real attestation provider.\n| **Warning:** The debug provider allows access to your Firebase resources from unverified devices. **Don't** use the debug provider in production builds of your app, and **don't** share your debug builds with untrusted parties.\n\nUse the debug provider on localhost\n\nTo use the debug provider while running your app from `localhost` (during\ndevelopment, for example), do the following:\n| **Warning:** *Do not* try to enable `localhost` debugging by adding `localhost` to reCAPTCHA's allowed domains. Doing so would allow anyone to run your app from their local machines!\n\n1. In your debug build, enable debug mode by setting\n `self.FIREBASE_APPCHECK_DEBUG_TOKEN` to `true` before you initialize\n App Check. For example:\n\n Web \n\n self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;\n initializeAppCheck(app, { /* App Check options */ });\n\n Web \n\n self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;\n firebase.appCheck().activate(/* site key or provider */);\n\n | **Note:** In Firebase Web SDK versions before v9, `self.FIREBASE_APPCHECK_DEBUG_TOKEN` is read at import time, and not at initialization/activation time. This required it to be set in `index.html` before the code bundle is loaded. To avoid this restriction, upgrade to v9.\n2. Visit your web app locally and open the browser's developer tool. In the\n debug console, you'll see a debug token:\n\n ```\n AppCheck debug token: \"123a4567-b89c-12d3-e456-789012345678\". You will\n need to safelist it in the Firebase console for it to work.\n ```\n3. In the [**App Check**](//console.firebase.google.com/project/_/appcheck) section\n of the Firebase console, choose **Manage debug tokens** from your app's\n overflow menu. Then, register the debug token you logged in the previous\n step.\n\nAfter you register the token, Firebase backend services will accept it as valid.\n\nBecause this token allows access to your Firebase resources without a\nvalid device, it is crucial that you keep it private. Don't commit it to a\npublic repository, and if a registered token is ever compromised, revoke it\nimmediately in the Firebase console.\n\nThis token is stored locally in your browser and will be used whenever you use\nyour app in the same browser on the same machine. If you want to use the\ntoken in another browser or on another machine, set\n`self.FIREBASE_APPCHECK_DEBUG_TOKEN` to the token string instead of `true`.\n\nUse the debug provider in a CI environment\n\nTo use the debug provider in a continuous integration (CI) environment, do the following:\n\n1. In the [**App Check**](//console.firebase.google.com/project/_/appcheck) section\n of the Firebase console, choose **Manage debug tokens** from your app's\n overflow menu. Then, create a new debug token. You'll need the token in the\n next step.\n\n Because this token allows access to your Firebase resources without\n a valid device, it is crucial that you keep it private. Don't commit it to a\n public repository, and if a registered token is ever compromised, revoke it\n immediately in the Firebase console.\n\n2. Add the debug token you just created to your CI system's secure key store\n (for example, GitHub Actions' [encrypted secrets](https://docs.github.com/en/actions/reference/encrypted-secrets)\n or Travis CI's [encrypted variables](https://docs.travis-ci.com/user/environment-variables/#defining-encrypted-variables-in-travisyml)).\n\n3. If necessary, configure your CI system to make your debug token available\n within the CI environment as an environment variable. Name the variable\n something like `APP_CHECK_DEBUG_TOKEN_FROM_CI`.\n\n4. In your debug build, enable debug mode by setting\n `self.FIREBASE_APPCHECK_DEBUG_TOKEN` to the value of the debug token\n environment variable before you import App Check. For example:\n\n Web \n\n self.FIREBASE_APPCHECK_DEBUG_TOKEN = process.env.APP_CHECK_DEBUG_TOKEN_FROM_CI;\n initializeAppCheck(app, { /* App Check options */ });\n\n Web \n\n self.FIREBASE_APPCHECK_DEBUG_TOKEN = process.env.APP_CHECK_DEBUG_TOKEN_FROM_CI;\n firebase.appCheck().activate(/* site key or provider */);\n\nWhen your app runs in a CI environment, Firebase backend services will accept\nthe token it sends as valid."]]
