Flutter证书锁定网络请求插件 certificate_pinning_httpclient 的使用

certificate_pinning_httpclient 是一个实现了带有证书锁定功能的 HttpClient 插件。锁定是基于 SPKI（主题公钥信息）SHA-256 哈希值进行的。客户端将通过 MethodChannel 下载证书并缓存它们，所有与 SPKI 哈希匹配的证书将用于 SecurityContext。

使用方法

获取 SPKI 哈希值

客户端会记录每个证书链中的 SPKI 哈希值。你可以使用这些哈希值来配置你的应用。你也可以通过 GnuTLS 来获取哈希值：gnutls-cli --print-cert example.com （查找 Public Key PIN）。

示例代码

使用 http 包

import 'package:certificate_pinning_httpclient/certificate_pinning_httpclient.dart';
import 'package:http/io_client.dart';

final client = IOClient(CertificatePinningHttpClient(
    ["S4kZuhQQ1DPcMOCYFQXD0gG+UW0zmyVx6roNWpRl65I="]));

使用 Dio 包

import 'package:certificate_pinning_httpclient/certificate_pinning_httpclient.dart';
import 'package:dio/dio.dart';
import 'package:dio/io.dart';

final _dio = Dio();
(_dio.httpClientAdapter as IOHttpClientAdapter).onHttpClientCreate =
    (client) => CertificatePinningHttpClient(
        ["S4kZuhQQ1DPcMOCYFQXD0gG+UW0zmyVx6roNWpRl65I="]);

禁用日志（适用于发布版本）

import 'package:logger/logger.dart';

Logger.level = kDebugMode ? Level.debug : Level.nothing;

完整示例 Demo

以下是一个完整的 Flutter 应用示例，展示了如何使用 certificate_pinning_httpclient 插件：

import 'package:certificate_pinning_httpclient/certificate_pinning_httpclient.dart';
import 'package:dio/dio.dart';
import 'package:dio/io.dart';
import 'package:flutter/material.dart';
import 'package:http/io_client.dart';

void main() {
  runApp(const MyApp());
}

class MyApp extends StatelessWidget {
  const MyApp({super.key});

  @override
  Widget build(BuildContext context) {
    return MaterialApp(
      title: 'Flutter Demo',
      theme: ThemeData(
        primarySwatch: Colors.blue,
      ),
      home: const MyHomePage(title: 'Certificate Pinning Demo'),
    );
  }
}

class MyHomePage extends StatefulWidget {
  const MyHomePage({super.key, required this.title});

  final String title;

  @override
  State<MyHomePage> createState() => _MyHomePageState();
}

class _MyHomePageState extends State<MyHomePage> {
  int _httpStatus = 0;
  int _dioStatus = 0;
  String _httpError = "";
  String _dioError = "";
  static const String exampleComSpki =
      "Xs+pjRp23QkmXeH31KEAjM1aWvxpHT6vYy+q2ltqtaM="; // 可能过期

  final _http = IOClient(CertificatePinningHttpClient([exampleComSpki]));
  final _dio = Dio();

  _MyHomePageState() {
    (_dio.httpClientAdapter as IOHttpClientAdapter).onHttpClientCreate =
        (client) => CertificatePinningHttpClient([exampleComSpki]);
  }

  Future<void> _makeHttpCall(String url) async {
    int httpStatus = -1;
    int dioStatus = -1;
    String? httpError;
    String? dioError;

    try {
      httpStatus = (await _http.get(Uri.parse(url))).statusCode;
    } catch (err) {
      httpError = err.toString();
    }

    try {
      dioStatus = (await _dio.get(url)).statusCode!;
    } catch (err) {
      dioError = err.toString();
    }

    setState(() {
      _httpStatus = httpStatus;
      _dioStatus = dioStatus;
      _httpError = httpError ?? "";
      _dioError = dioError ?? "";
    });
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      appBar: AppBar(
        title: Text(widget.title),
      ),
      body: Center(
        child: Column(
          mainAxisAlignment: MainAxisAlignment.center,
          children: <Widget>[
            TextButton(
              onPressed: () {
                _makeHttpCall("https://example.com");
              },
              child: const Text("GET example.com"),
            ),
            TextButton(
              onPressed: () {
                _makeHttpCall("https://pub.dev");
              },
              child: const Text("GET pub.dev (with invalid pins)"),
            ),
            const SizedBox(height: 20),
            Text('Http status from http client: $_httpStatus'),
            Text('Http status from dio client: $_dioStatus'),
            const SizedBox(height: 20),
            if (_httpError.isNotEmpty)
              Text("Error from http client: $_httpError"),
            const SizedBox(height: 20),
            if (_dioError.isNotEmpty) Text("Error from dio client: $_dioError"),
          ],
        ),
      ),
    );
  }
}

致谢

感谢 Approov 提供的基础工作。