Dart uses sockets in order to make its HTTPS requests, which means any enforced HTTPS policies forced by the OS will be ineffective and won't work if we are using the dart HTTP stack.
An app can have multiple sources that trigger an HTTP request, many of those we can't control as they can be in a third party library.
Currently we can force HTTPS only connections passing this zone configuration to a Flutter app:
zoneValues: {#flutter.io.allow_http: false},But I couldn't find this documented anywhere, thus could be changed at any time, so it's not a strong and guaranteed solution.
I this this configuration should be documented and also we should have a higher level mechanism for configuring it and not having to rely on Zone configurations for dealing with the HTTP stack configurations.
(Migrated from: flutter/flutter#95341)
Dart uses sockets in order to make its HTTPS requests, which means any enforced HTTPS policies forced by the OS will be ineffective and won't work if we are using the dart HTTP stack.
An app can have multiple sources that trigger an HTTP request, many of those we can't control as they can be in a third party library.
Currently we can force HTTPS only connections passing this zone configuration to a Flutter app:
But I couldn't find this documented anywhere, thus could be changed at any time, so it's not a strong and guaranteed solution.
I this this configuration should be documented and also we should have a higher level mechanism for configuring it and not having to rely on Zone configurations for dealing with the HTTP stack configurations.
(Migrated from: flutter/flutter#95341)