Check certificate while sending and receiving data about ssl_pinning_plugin HOT 8 OPEN

There is inbuilt support for SSL pinning in dart but it does not cover all the cases. A possible alternative would be to get inbuilt support fixed.

Checkout this and this

HttpClient client = new HttpClient();
client.badCertificateCallback = ((X509Certificate cert, String host, int port) {
final isValidHost = host == "api.my_app";
return isValidHost;
});
what is this host checking here can anyone explains it.

In the code snippet you are checking if the request is coming from the desired host. I am not sure about your use case but this does not help us with MITM attacks.

from ssl_pinning_plugin.

Hi @us3soap, thank you for creating an awesome plugin. We are looking forward to using this but this issue mentioned above is holding us back. Please let me know what would it take to add "certificate check" into the plugin so we safely implement cert pinning through this plugin. Thanks very much for your contribution!

from ssl_pinning_plugin.

Hi, sorry for the delay.

Do you need support or evolution ?

from ssl_pinning_plugin.

As mentioned by @mleonhard in this thread, i guess the plugin makes a separate call to same domain for validating the keys.

Therefore, two calls are being made for every request where we need SSL pinning. It would be really nice if we can validate Certificate Key in the original request itself.

from ssl_pinning_plugin.

@SahilPatel16 do we have anything alternative to these solution. I found this code in stackoverflow

HttpClient client = new HttpClient();
client.badCertificateCallback = ((X509Certificate cert, String host, int port) {
final isValidHost = host == "api.my_app";
return isValidHost;
});
what is this host checking here can anyone explains it.

from ssl_pinning_plugin.

Any update?

from ssl_pinning_plugin.

Bump! Any update on this issue?

from ssl_pinning_plugin.

It's been three years since this was opened, let us know if there's any update.

from ssl_pinning_plugin.