Flutterfire: [firebase_auth] Firebase Auth does not seem to pass iOS bundle id information during Phone Verification reCAPTCHA workflow.

[cielo]

Describe the bug
Firebase Auth does not properly pass iOS bundle id information to backend during Phone Verification reCAPTCHA workflow. Because of this, phone verification with reCAPTCHA workflow always get rejected, if API key is restricted to specific app identified by bundle id.

To Reproduce
Steps to reproduce the behavior:

1. Check out FirebaseAuth sample app and run it. (Any firebase app that uses FirebaseAuth could show this problem) https://github.com/FirebaseExtended/flutterfire/tree/master/packages/firebase_auth/firebase_auth/example
2. Go to google cloud console's credentials page, and restrict the API key from GoogleService-Info.plist to be only usable with iOS app with bundle id 'io.flutter.plugins.firebaseAuthExample'.
3. Attempt to sign in with PhoneAuthProvider in iOS simulator.
4. App will redirect you to reCAPCHA flow because you are using iOS simulator. However, callback will be returned with error information.

flutter: verifyPhoneNumberError - {"error":{"code":403,"message":"Requests from this ios client application <empty> are blocked.","errors":[{"message":"Requests from this ios client application <empty> are blocked.","domain":"global","reason":"forbidden"}],"status":"PERMISSION_DENIED"}}
Above error indicates that some form of id or token wasn't passed, so auth handler could not identify the caller and<empty> was returned instead.

Since the above error does not happen when there is no bundle id restriction in API key, I think that FirebaseAuth isn't properly parsing or passing app id/token information to the Firebase Auth backend.

This behavior seems to be auth specific, as I can still use Firestore or other Firebase services without any issue after restricting the API access, and I am having this empty app id problem only in Firebase Auth Phone verification. (Even email auth works fine)

Expected behavior
App identification info should be passed correctly, and VerifyPhoneNumber with reCAPCHA flow should end successfully even when API key is restricted to a specific iOS apps.

Additional context
Add any other context about the problem here.

flutter doctor -v
[✓] Flutter (Channel stable, v1.12.13+hotfix.7, on Mac OS X 10.15.3 19D76, locale en)
    • Flutter version 1.12.13+hotfix.7 at /Users/user/Dev Tools/flutter/flutter-1.12.13+hotfix.7
    • Framework revision 9f5ff2306b (7 days ago), 2020-01-26 22:38:26 -0800
    • Engine revision a67792536c
    • Dart version 2.7.0

[✓] Android toolchain - develop for Android devices (Android SDK version 29.0.3)
    • Android SDK at /Users/user/Library/Android/sdk
    • Android NDK location not configured (optional; useful for native profiling support)
    • Platform android-29, build-tools 29.0.3
    • Java binary at: /Applications/Android Studio.app/Contents/jre/jdk/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 1.8.0_202-release-1483-b49-5587405)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 11.3.1)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Xcode 11.3.1, Build version 11C504
    • CocoaPods version 1.8.4

[✓] Android Studio (version 3.5)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin version 43.0.1
    • Dart plugin version 191.8593
    • Java version OpenJDK Runtime Environment (build 1.8.0_202-release-1483-b49-5587405)

[✓] Connected device (1 available)
    • iPhone 8 • E8B94077-0C63-4CAD-A6FC-225654F5AD11 • ios • com.apple.CoreSimulator.SimRuntime.iOS-13-3 (simulator)

• No issues found!

FirebaseAuth version: 0.15.4
FirebaseCore version: 0.4.3

[hnguyenworkstation]

any news on this topic? I seem to have the same issue

[mobileappbyharis]

same issue

[Mauratay]

Having the same problem, when using API restriction to be used from app only I get 403's

[voyager163]

I having the same issue. I already highlighted to Google Cloud Platform support helpdesk. I will keep the group updated.

[kovalenko-tech]

I having the same issue.

[Salakar]

Hey 👋

Our rework of the firebase_auth plugin as part of the FlutterFire roadmap was published over a week ago with a ton of fixes and new features.

Please could you try the new version and see if this is still an issue on the latest release? If it is then please could someone submit a new up to date GitHub issue so it's easy to track.

For help migrating to the new plugins please see the new migration guide: https://firebase.flutter.dev/docs/migration