getIdToken 和 getAppCheckToken 有什么区别？

Question

Currently firebase has introduce the App Check. To protect the non firebase backend firebase has introduce getAppCheckToken. Previously we are using the getIdToken to verify the user.

 FirebaseAuth.getInstance().currentUser.getIdToken(true).addOnSuccessListener {
    Log.d("tag",it.token) // token #1
}

FirebaseAppCheck.getInstance()
        .getAppCheckToken(false)
        .addOnSuccessListener { tokenResponse ->
    Log.d("tag",tokenResponse) // token #1
}

What's difference between both this two token. How getAppCheckToken can improve the security of the non firebase backend.

Answer 1

Basically the difference between getIdToken and getAppCheckToken is:

FirebaseAuth.getInstance().currentUser.getIdToken(true){}

Fetches a Firebase Auth ID Token for the user; useful when authenticating against your own backend, if forceRefresh == true, thrown if the current user's account has been disabled, deleted, or its credentials are no longer valid.

FirebaseAppCheck.getInstance().getAppCheckToken(true){}

Requests a Firebase App Check token. This method should be used ONLY if you need to authorize requests to a non-Firebase backend. Requests to Firebase backends are authorized automatically if configured.