Dart and Flutter secure coding¶

Dart code may run as a server, a command-line application or part of a Flutter app. The network trust boundary differs across these environments. This guide uses dart:io HttpClient, available on supported native platforms; it does not describe browser-managed TLS in Flutter web.

Preserve certificate validation¶

A temporary callback that accepts every certificate can survive into a release. Both examples create a client for requests to services the application is allowed to contact.

Unsafe: accept certificates that normal validation rejects.

import 'dart:io';

final client = HttpClient()
  ..badCertificateCallback = (cert, host, port) => true;

Safer: retain the client's default validation.

import 'dart:io';

final client = HttpClient();

The default does not install an unconditional acceptance callback. Requests fail when the server certificate cannot be authenticated through the configured trust context. Dart's badCertificateCallback reference explains when the callback is consulted and how its return value affects the connection.

If a private service requires a private certificate authority, configure a deliberate trust context for that environment. Do not accept any certificate simply because its hostname matches a string supplied by the caller. Keep development trust material and settings separate from the production build. Close the client when its owning service is disposed, and handle connection failures without exposing tokens in logs.

Check the fix¶

Use two endpoints controlled by your test team: one with a certificate trusted by the intended client configuration and one with an untrusted certificate. Verify that the first request succeeds and the second fails. Ensure the test does not silently replace the client or install a permissive callback. No third-party service needs to be contacted.

For Flutter, also review platform storage, WebView HTML handling and native platform-channel inputs. A server-side URL fetch needs destination controls against SSRF; a mobile client's networking alone is a different threat model. Continue with certificate validation, hardcoded keys, insecure randomness and XSS.

This example addresses one TLS bypass pattern. Scanner checks and platform behavior depend on the project's runtime, framework and configuration; source analysis does not replace a release-build networking test.