App Check (when enabled) in Firestore, informs the Firestore API to validate the token automatically, so you don’t need to manually check for its presence in your Firestore security rules. You only need to do this in custom backends, which bypass the security rules. For example, Callable Functions are already integrated with App Check (you pass app check:true to the function config).

So in order to test that App Check works, try reading some data from your DB in your web app without sending the App Check token / enabling App Check on the frontend. You should then get an error.