🐛 [firebase_app_check] Add support for a whitelist

[MarcVanDaele90]

What feature would you like to see?

Our Flutter/web app, using appcheck(recaptchaV3), is used in a number of schools.
This works fine for most schools but in some schools, a lot of children can't pass the AppCheck validation. After some time it may work correctly again.

Of course I would like to understand the root cause and understand why recaptchaV3 returns a low score.
So a contact point at the recaptcha team would be very helpful.

But as a workaround, I would like to be able to create a whitelist of IP-addresses.
Would it make sense to add this to firebase_app_check?

If not, would it be feasible for me to create my own attestation provider that

• first checks the whitelist
• next delegates to recaptchaV3

Any suggestions on how to get started with this?

[darshankawar]

@MarcVanDaele90
Check if https://stackoverflow.com/questions/76461078/firebase-app-check-and-recaptcha-v3-enterprise-integration-billing-and-token-re helps in your case or not.
Also, I think this case is more suited for discussion so moving this issue there.

[MarcVanDaele90]

I'm aware of https://firebase.google.com/docs/app-check/custom-provider and https://firebase.google.com/docs/app-check/web/custom-provider where it is said that " You can, however, also implement your own custom App Check providers". Unfortunately, these examples don't translate well to Flutter afaics.

Currently I use

      await FirebaseAppCheck.instance.activate(
          webProvider: ReCaptchaV3Provider(appCheckKey)
      );

So in an ideal world, I would just subclass ReCaptchaV3Provider and override a function where I can first check my whitelist and delegate to super if needed. Other suggestions on how to create a custom App Check provider in Flutter?