[Bug] Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject

[RubDevRG]

Description

Hey, I’m currently working more actively on getting App Check running properly in my live project.
I’ve added several detailed log outputs around my initialization process to better understand what’s happening and to enforce App Check sooner or later.

This is the most common App Check error I’m encountering at the moment, and I haven’t been able to find any information on how to resolve it:

App Check Provider: Play Integrity
Affected Users: ~15%
Happens on regular Samsung phones as well, so nothing unusual.

Reproducing the issue

Hard to reproduce locally since it’s affecting specific users in the live build. In general, it’s just a standard Firebase installation with App Check and Play Integrity for Android.

Firebase Unity SDK Version

13.4.0

Unity editor version

6000.0.60f1

Installation Method

.unitypackage

Problematic Firebase Component(s)

App Check

Other Firebase Component(s) in use

Analytics

Additional SDKs you are using

No response

Targeted Platform(s)

Android

Unity editor platform

Windows

Scripting Runtime

IL2CPP

Release Distribution Type

Pre-built SDK from https://firebase.google.com/download/unity

Relevant Log Output

<Warning>: App Check init failed: System.AggregateException: One or more errors occurred. (Provider returned an Exception: System.AggregateException: One or more errors occurred. (Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject) ---> Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject
   --- End of inner exception stack trace ---
---> (Inner Exception #0) Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject<---
) ---> Firebase.FirebaseException: Provider returned an Exception: System.AggregateException: One or more errors occurred. (Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject) ---> Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject
   --- End of inner exception stack trace ---
---> (Inner Exception #0) Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject<---

   --- End of inner exception stack trace ---
  at Firebase.AppCheck.FirebaseAppCheck+<>c.<GetAppCheckTokenAsync>b__13_0 (System.Threading.Tasks.Task`1[TResult] task) [0x00000] in <00000000000000000000000000000000>:0 
  at System.Threading.Tasks.ContinuationResultTaskFromResultTask`2[TAntecedentResult,TResult].InnerInvoke () [0x00000] in <00000000000000000000000000000000>:0 
  at System.Threading.Tasks.Task.Execute () [0x00000] in <00000000000000000000000000000000>:0 
  at System.Threading.ExecutionContext.RunInternal (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state, System.Boolean preserveSyncCtx) [0x00000] in <00000000000000000000000000000000>:0 
  at System.Threading.Tasks.Task.ExecuteWithThreadLocal (System.Threading.Tasks.Task& currentTaskSlot) [0x00000] in <00000000000000000000000000000000>:0 
  at System.Threading.Tasks.Task.ExecuteEntry (System.Boolean bPreventDoubleExecution) [0x00000] in <00000000000000000000000000000000>:0 
  at System.Threading.ThreadPoolWorkQueue.Dispatch () [0x00000] in <00000000000000000000000000000000>:0 
--- End of stack trace from previous location where exception was thrown ---

  at FirebaseSetup.InitializeAsyncInternal () [0x00000] in <00000000000000000000000000000000>:0 
  at System.Threading.ExecutionContext.RunInternal (System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, System.Object state, System.Boolean preserveSyncCtx) [0x00000] in <00000000000000000000000000000000>:0 
  at System.Runtime.CompilerServices.AsyncMethodBuilderCore+MoveNextRunner.Run () [0x00000] in <00000000000000000000000000000000>:0 
  at UnityEngine.UnitySynchronizationContext+WorkRequest.Invoke () [0x00000] in <00000000000000000000000000000000>:0 
  at UnityEngine.UnitySynchronizationContext.Exec () [0x00000] in <00000000000000000000000000000000>:0 
---> (Inner Exception #0) Firebase.FirebaseException: Provider returned an Exception: System.AggregateException: One or more errors occurred. (Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject) ---> Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject
   --- End of inner exception stack trace ---
---> (Inner Exception #0) Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject<---
<---

If using CocoaPods for Apple platforms, the project's Podfile.lock

No response

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[niccolo-hare]

Hi @RubDevRG, thanks for reaching out. I tried running a couple of sample projects based on our Quickstart samples, but I didn't encounter any issues with setting up App Check and running them on an emulator from Android Studio. I'm also able to confirm that AppCheck was initialized since it was able to block my test apps that didn't have a valid debug token.

Upon checking the stack trace you shared, it's not quite clear what's causing the issue. My guess is that the SDK is receiving an error from AppCheck which it is trying to parse into JSON, but is unable to do so. For example, if it receives a 403 Forbidden error from AppCheck, but as an HTML response instead of a JSON. As such, this error is logged by the SDK instead.

The above is just one scenario where the error could likely occur. So to help us investigate further and narrow down the cause, could you answer the following questions:

• Are you using another Firebase product where you are directly communicating with one of Firebase's endpoints? Or does your app have a feature that is calling a custom backend or Cloud Function?
• If so, are you seeing any server-side errors or App Check validation failures that could be related to these client-side errors?
• Are you seeing any patterns or similarities when the issue occurs?
  • Are these users running your app under a strict network restriction/security or through a VPN?
  • Does it occur on a specific version of your app?
  • Are the device models or OS versions the same?
• What is your token's time-to-live setting?
• Under Advanced settings in AppCheck, which options are selected for your app:
  • Require PLAY_RECOGNIZED
  • Require LICENSED
• Is the check integrity option enabled? And which level did you select? (Basic, Device or Strong)

[RubDevRG]

Hey @niccolo-hare, thanks for jumping on this.

Just to clarify I pushed an update to narrow down the issue and identify exactly how many players are encountering the specific error mentioned.

Over a 2-day period, I’m seeing 8% of users hitting this exact error:

System.AggregateException: One or more errors occurred. 
(Provider returned an Exception: System.AggregateException: One or more errors occurred. 
(Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject) 
---> Firebase.FirebaseException: Value <!DOCTYPE of type java.lang.String cannot be converted to JSONObject

Additionally, around 2% are getting other errors, such as network issues or “too many attempts” errors.
(I'm retrying the app check token retrieval up to three times after a failed attempt.)

Here are some of the devices showing this error i can’t tell whether they’re rooted or which countries they’re from:
samsung SM-M325F, samsung SM-A256E, samsung SM-A315F, realme RMX2180, samsung SM-A546E, samsung SM-A520F, Xiaomi M2101K7BG

It seems the issue lies in how Firebase behaves in this case. Instead of just throwing an exception when it receives the wrong type, it would be more helpful if it actually logged or exposed the response content so developers can see what’s going on.
Right now, it just throws the error without context.

Here’s also the part of the code where I’m initializing it:

    private async Task<bool> InitializeAsyncInternal()
    {
        if (app != null && db != null)
        {
            return true;
        }

        try
        {
#if UNITY_ANDROID && !UNITY_EDITOR
            FirebaseAppCheck.SetAppCheckProviderFactory(PlayIntegrityProviderFactory.Instance);
#elif UNITY_IOS && !UNITY_EDITOR
            FirebaseAppCheck.SetAppCheckProviderFactory(AppAttestProviderFactory.Instance);
#elif UNITY_EDITOR
            //FirebaseAppCheck.SetAppCheckProviderFactory(DebugAppCheckProviderFactory.Instance);
            //DebugAppCheckProviderFactory.Instance.SetDebugToken("");
#endif
            SetConsent();

            var dependencyStatus = await FirebaseApp.CheckAndFixDependenciesAsync();
            if (dependencyStatus == DependencyStatus.Available)
            {
                app = FirebaseApp.DefaultInstance;

                await InitializeAppCheckAsync();

                db = FirebaseFirestore.GetInstance(app);

                InitializeRemoteConfigAsync();
                OnFirebaseInitialized();

                await TrustedTime.Instance.InitializeAsync();

                return true;
            }
            else
            {
                return false;
            }
        }
        catch (Exception ex)
        {
            BacktraceLogger.Instance.LogInfo("FirebaseSetup init failed: " + ex.ToString());

            lock (_initLock)
            {
                _initTask = null;
            }
            return false;
        }
    }

    private async Task InitializeAppCheckAsync()
    {
        try
        {
            var appCheck = FirebaseAppCheck.GetInstance(app);
            appCheck.SetTokenAutoRefreshEnabled(true);

            var tries = 0;

            while (tries++ < 3)
            {
                try
                {
                    var token = await appCheck.GetAppCheckTokenAsync(false);
                    if (!string.IsNullOrEmpty(token.Token))
                    {
                        break;
                    }
                }
                catch (Exception tokenEx)
                {
                    if (tokenEx.Message.Contains("<!DOCTYPE") || tokenEx.Message.Contains("JSONObject") || tokenEx.ToString().Contains("<!DOCTYPE"))
                    {
                        BacktraceLogger.Instance.LogInfo($"[Firebase/AppCheck] App Check Play Integrity HTML Error: Device does not support Play Integrity API properly. " + $"Attempt: {tries}/3. Error: {tokenEx.Message}");
                        break;
                    }
                    else
                    {
                        if (tries >= 3)
                        {
                            BacktraceLogger.Instance.LogInfo($"[Firebase/AppCheck] App Check Token failed after 3 attempts: {tokenEx}");
                        }
                    }
                }

                if (tries < 3)
                {
                    await Task.Delay(500);
                }
            }
        }
        catch (Exception ex)
        {
            BacktraceLogger.Instance.LogInfo($"[Firebase/AppCheck] App Check init general failure: {ex}");
        }
    }

My guess is that instead of receiving the correct URL response (which should return a JSON document), it’s getting a 404 error page or something similar which would trigger that specific Firebase issue.

So, it’s likely that some users from restricted regions (such as Russia, China, or Iran) are trying to authenticate with App Check, but their requests are being blocked. Even if that’s the case, the Firebase SDK shouldn’t just throw a generic exception. It should handle the response and provide a clear informational message similar to how it does for network errors.

I tried forcing the issue by connecting through a Russian or Iranian VPN, but I still couldn’t reproduce the problem. The only untested possibilities are using a different key for building or testing on a rooted device, in case that might cause the error log.

[niccolo-hare]

Thanks for these additional details @RubDevRG. The response does seem a bit ambiguous. Let me investigate this further and see if this is intended behavior or if there's a workaround available which may help us get more context into these types of errors. I'll reply back once I have an update or more information to share.