All 7 Flutter App Security Best Practices questions
More in Flutter App Security Best Practices
Why should sensitive information, such as an API key or a secret token, never be hardcoded directly within a Flutter app's actual source code? How does the flutter_secure_storage package let you securely store sensitive data, such as an authentication token, on a user's device using each platform's own native secure storage mechanism? How can code obfuscation help protect a Flutter app's actual business logic from being easily reverse engineered by an attacker who obtains a copy of the compiled release build? How should a Flutter app properly validate and sanitize any data received from a server, rather than blindly and unconditionally trusting that all incoming data is genuinely already safe and well formed? How do biometric authentication methods, such as fingerprint or face recognition, add an additional meaningful layer of security to a sensitive Flutter app, and how does the local_auth package help implement this feature? How should a Flutter app properly detect whether it is currently running on a rooted Android device or a jailbroken iOS device, and what genuine security risks does running on such a compromised device actually introduce?
Advertisement
Flutter › Flutter App Security Best Practices

Why is enforcing certificate pinning important for a Flutter app handling genuinely sensitive data, and how does it help protect against a man in the middle attack?

Intermediate

Answer

Certificate pinning means your app is explicitly configured to only trust one specific, known certificate or public key when communicating with your backend server, rather than automatically trusting any certificate that happens to be issued by any generally trusted certificate authority, and this meaningfully helps protect against a man in the middle attack, where a malicious actor attempts to intercept and potentially read or modify network traffic between your app and your genuine server by presenting their own fraudulent certificate, since your app will correctly reject that fraudulent certificate outright because it simply does not match the one specific certificate it was explicitly configured to trust.
final dio = Dio();
(dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate = (client) {
  client.badCertificateCallback = (cert, host, port) => validateCertificate(cert);
  return client;
};
Real-world example A financial trading app implements certificate pinning specifically for all of its API communication, ensuring that even if a user is unknowingly connected through a genuinely compromised public network, their sensitive trading data still cannot actually be intercepted through a fraudulent certificate based man in the middle attack.

Common follow-ups: What happens if your server's actual certificate is later legitimately rotated or renewed, and how does that affect a certificate pinned app?;What are the practical maintenance tradeoffs of implementing certificate pinning?

Networking with HTTP & Dio;Flutter App Security Best Practices
All 7 Flutter App Security Best Practices questions