Overview
A Flutter package that enables HTTPS certificate pinning to enhance security by verifying server certificates against known SHA-1 or SHA-256 fingerprints. It ensures the connection is secure by validating that the server's certificate matches a predefined, trusted fingerprint, protecting against man-in-the-middle attacks. The package integrates with HTTP clients and supports both Android and iOS platforms.
Use cases
- Securing API communications in sensitive apps
- Preventing MITM attacks on mobile networks
- Validating server identity in financial or healthcare apps
- Enforcing trust in custom or internal APIs
Key features
- Supports SHA-1 and SHA-256 fingerprint validation
- Easy integration with HTTP clients
- Cross-platform (Android & iOS)
- Simple configuration via fingerprints
- Runtime certificate verification
Suitable for
- Security-conscious mobile applications
- Apps handling sensitive user data
- Enterprise-grade network communication
- Developers implementing strict TLS policies
Considerations
- Requires accurate and up-to-date certificate fingerprints
- Fingerprint changes require app updates
- Not suitable for dynamic or frequently changing endpoints
- Manual management of certificate trust boundaries