Flutter How To Change http.dart Connection To SSL HTTPS

Question

I'm currently using the http lib for a normal http connection. Does anyone know how to implement a certificate check into the http call so I can use SSL? I can't seem to find a clear answer on how to do this.

Here is a sample connection in my app:

  import 'package:http/http.dart' as http;


  String url = "https://www.mywebsite.com";
  print("Firing off url: ${url}");
  var request = http.MultipartRequest("POST", Uri.parse("${url}"));
  //cert check here maybe?



  //add POST fields
  request.fields["lookup"] = "true";
  request.fields["email"] = "blah@test.com";
  request.fields["user_id"] = "1337";

  var response = await request.send();
  var responseData = await response.stream.toBytes();
  var responseString = String.fromCharCodes(responseData);
  print('================================');
  print("response was: ${responseString}");
  if (response.statusCode == 200) {
    var json_data = json.decode(responseString);
    for (var u in json_data) {
      print(u["response"]);
    }
  }

have you tried https://stackoverflow.com/questions/51323603/how-to-do-ssl-pinning-via-self-generated-signed-certificates-in-flutter ? — Antonin GAVREL, Feb 15 '21 at 21:41
Not clear what you mean, https works out of the box and validates the server certificate. — kuhnroyal, Feb 18 '21 at 16:16
@kuhnroyal But how does it know what is a "good" cert without a check? — Petro, Feb 18 '21 at 22:24

score 1 · Accepted Answer · answered Feb 19 '21 at 00:19

The http package uses dart:io in the background. That's Darts built in IO library.

When you make an https connection with the httppackage, it uses a SecurityContext (https://api.flutter.dev/flutter/dart-io/SecurityContext-class.html) that binds to the systems certificate/trust store. This works for most operating systems. If the operating system has no native trust store, it uses https://github.com/dart-lang/root_certificates.

Since you tagged the question with Flutter, both Android and iOS contain a native trust store which Dart uses.

If you want to trust different certificates you can manipulate the SecurityContext and add/remove trusted certificates.

This may also help you to understand how it works: https://api.flutter.dev/flutter/dart-io/HttpClient-class.html

Flutter How To Change http.dart Connection To SSL HTTPS

1 Answers1