Firebase AppCheck VS 黑客和垃圾邮件请求

Question

尽管我完全了解 AppCheck 的用法，但我仍然想知道它如何帮助防止向 API 端点发送垃圾邮件请求。在黑客使用 OpenBullet 或任何黑客工具每分钟向特定端点发送数千个请求的情况下（例如，在社交应用程序中创建数千个虚假个人资料的注册端点）：

once the hacker got their hand on the appcheck token from the device, can't they simply attach it to the request's header, and spam all they want the api endpoint that we secured from our backend by checking appcheck token? I mean, as long as the TTL didn't expire, I guess all their requests will pass the check thus they could use their hacker tool and pretend to come from the untempered app? Or am I missing something?

I guess a solution would be to: 1- forceRefresh the appcheck token on each fetch request from the mobile app 2- expire the received appcheck token programmatically after successful verification from the backend, so that further request would need a new one that can only be generated from the app, thus making it harder for the hacker?

Any help is appreciated! :)

Answer 1

我会用不同的方式来表达。虽然 AppCheck 为您的资源提供一定程度的保护，但它并不能保证 100% 的保护。您提供的示例是有关如何绕过它的实例。但不能排除的是，AppCheck 使恶意行为者更难在您的服务中漫游并消耗您的预算。

查看文档中的这一部分。另请看一下这个问题，因为它是在您的问题之后提出的，并且有一个与之对应的 firebaser (Frank)。