Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Trust user installed certificates #11

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

johnstef99
Copy link

Instead of trusting all certificates using

client.badCertificateCallback =
            (X509Certificate cert, String host, int port) => true;

I created a plugin flutter_user_certificates_android for android that retrieves the CA certificates installed on the device by the user, so the HttpProxy override can trusts them.

On iOS this works out of the box with flutter and a request signed by a certificate installed by the user doesn't throw an Exception.

So by removing the badCertificateCallback:

  • iOS will automatically allow any request signed by a user installed certificate
  • Android will get the user certificates from the device and set them as trusted on any HttpClient created

This makes the plugin safe for use in production environments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant