Firebase messaging on android and permissions

Question

I recently added firebase messaging to my android app and I noticed some new permissions required to my app at similar time, for example: android.permission.READ_PHONE_STATE I couldn't find anywhere in documentation, why is this permission required. I even tried to explicitly disable it in manifest (tools:node="remove") and messaging still works for me. It's kinda messy and I want to use only as few permissions as I need for sake of my users.

Is this permissions really needed by messaging or is it added automatically from one of library dependencies? How can I tell what permissions is being added by what? I tried manifest-merger-report.txt, but there was no mention about READ_PHONE_STATE.

Thanks!

Answer 1

The READ_PHONE_STATE permission is not needed for Firebase Cloud Messaging to work (see the Edit your App Manifest docs).

From what I can tell, you've already done quite the digging with this tiopic (checking the manifest-merger-report.txt, adding tools:node="remove" to disable it). You've probably seen Commonsware's blog too.

It's hard to tell from where the READ_PHONE_STATE permission is coming from (with the current details your post), but it is most probably the cause of manifest merging. Try double checking if there are any dependencies that have the library's min SDK is lower than the app's min SDK, wherein if true, the permission is added, as per this answer:

The second one, READ_PHONE_STATE is because of the saxrssreader library. When the library's min SDK is lower than the app's min SDK, the permission is added during build. I simply changed the library's minimum SDK to the number my app is using and the permission is gone.

Answer 2

I had the same problem, i checked manifest-merger-report, and found that READ_PHONE_STATE was added because some library that I'm using has target version < 4

Here is exact quote from report:

ADDED from [com.google.firebase:firebase-messaging:10.2.0] C:\Users\user\project\app\build\intermediates\exploded-aar\com.google.firebase\firebase-messaging\10.2.0\AndroidManifest.xml:23:18-87 android:uses-permission#android.permission.READ_PHONE_STATE IMPLIED from C:\Users\user\project\app\src\main\AndroidManifest.xml:1:1-135:12 reason: org.apmem.tools.layouts has a targetSdkVersion < 4

Hope, this will help you. Question is possibly duplicate of: Firebase + Permissions

Answer 3

Firebase did not add this permission. Update your Google Play services to 10.0.1 as this bug seems to have been fixed in that version:

"This release fixes a missing minSdkVersion value in play-services-location.aar that caused unintended WRITE_EXTERNAL_STORAGE, READ_EXTERNAL_STORAGE, and READ_PHONE_STATE permissions to be merged into app manifests."

Answer 4

Ok this is embarrassing. I in the end, I was adding permissions myself in parent manifest. Thank you for your comments, based on those I managed to track it down.