Check certificate while sending and receiving data

[mleonhard]

My dartlang application performs network requests like this:

Future<List<int>> streamToBytes(Stream<List<int>> stream) => stream
        .fold(new BytesBuilder(), (BytesBuilder bytesBuilder, List<int> bytes) {
      bytesBuilder.add(bytes);
      return bytesBuilder;
    }).then((BytesBuilder bytesBuilder) => bytesBuilder.takeBytes());

final HttpClient client = new HttpClient();
Map<String, String> headers = Map.from(headers);
final HttpClientRequest request = await client.postUrl(url);
request.headers.set('user-agent', userAgent));
request.headers.contentLength = bytes.length;
request.add(bytes);
final HttpClientResponse response = await request.close();
final List<int> bytes = await streamToBytes(response);
return new HttpResponse(response.statusCode, response.reasonPhrase,
        response.headers.value(HttpHeaders.contentTypeHeader) ?? '', bytes);

Please add a way to check the certificate used by such requests, to protect the data sent and received by the app.

[smian-esba]

Hi @us3soap, thank you for creating an awesome plugin. We are looking forward to using this but this issue mentioned above is holding us back. Please let me know what would it take to add "certificate check" into the plugin so we safely implement cert pinning through this plugin. Thanks very much for your contribution!

[us3soap]

Hi, sorry for the delay.

Do you need support or evolution ?

[sahil-oyo]

As mentioned by @mleonhard in this thread, i guess the plugin makes a separate call to same domain for validating the keys.

Therefore, two calls are being made for every request where we need SSL pinning. It would be really nice if we can validate Certificate Key in the original request itself.

[basnetjiten]

@SahilPatel16 do we have anything alternative to these solution. I found this code in stackoverflow

HttpClient client = new HttpClient();
client.badCertificateCallback = ((X509Certificate cert, String host, int port) {
final isValidHost = host == "api.my_app";
return isValidHost;
});
what is this host checking here can anyone explains it.

[sahil-oyo]

There is inbuilt support for SSL pinning in dart but it does not cover all the cases. A possible alternative would be to get inbuilt support fixed.

Checkout this and this

---

HttpClient client = new HttpClient();
client.badCertificateCallback = ((X509Certificate cert, String host, int port) {
final isValidHost = host == "api.my_app";
return isValidHost;
});
what is this host checking here can anyone explains it.

In the code snippet you are checking if the request is coming from the desired host. I am not sure about your use case but this does not help us with MITM attacks.

[bkhezry]

Any update?

[akrmr]

Bump! Any update on this issue?

[shubhamhackz]

It's been three years since this was opened, let us know if there's any update.