Testing phone verification with restricted keys in the iOS Simulator

[martin-braun]

I wanted to comment this on #7653, but it's locked. Basically, the iOS Simulator will attempt to use the reCAPTCHA fallback on the phone authentication method that will always fail on restricted keys.

First of all, the error message was not helpful and cost me quite some time to figure out, why the bundle ID was not sent, so if nothing can be done about it, at least log to the console that the reCATCHA method will fail for restricted keys.

Secondly, why? Could the iOS Simulator work without reCAPTCHA method, please? Without it, it's impossible to test the work flow with restricted keys without owning a real device. Luckily I own a real device, but I don't speak for me now, I want to speak for anyone who might does not.

Thank you. :)

[steniowagner]

@martin-braun were you able to solve the problem? I'm having a similar issue with React-native in production mode (real device)... :(

Please let me know if you have any news on this.

[martin-braun]

It's barely documented and threads are old. On your restricted key, enable all Firebase APIs, but also enable the Identity Toolkit API. This was missing for me. After that it worked for the real device. (For Android, you also have to enable Android Device Verification, which is not necessary for the iOS key for obvious reasons.)

[martin-braun]

Just for the record. This issue also affects the Android Emulator and any Android Device that is not part of the Android Compatibility Test Suite (CTS). I decided to open an issue about it (firebase/firebase-android-sdk#1757), because it will not even affect real devices. On iOS it might be nearly impossible to use custom ROMs, on Android devices it's not that exotic giving the rise of privacy OSes like GrapheneOS. These custom ROMs as well as older devices are not part of the CTS and thus restricted keys will make the authentication fail.

I know how this issue can be treated rightfully and I want to quote myself here:

Why is the reCAPTCHA fallback not using the Firebase Browser API key instead?

In my browser key, I could whitelist <PROJECT_ID>.firebaseapp.com/* as a valid HTTP referrer and things could work out. This is not working, the reCAPTCHA workflow tries to pass-through the Android API key restrictions, which is impossible.

If the reCAPTCHA workflow would use the browser API key, even the iOS Simulator as well as the Android Emulator would succeed in verifying the device. This would improve the ability to verify SMS authentication is working, before testing it on a real device, so I see this as a good enhancement and nobody is forced to be part of it, because it would require to whitelist the firebase URL first-hand.

cc @darshankawar