Day by day the popularity of flutter is increasing among developers and entrepreneurs. Flutter has emerged as one of the leading and popular cross-platform app development frameworks because of its integral capability to deliver best native user experience, faster development through code reusability, faster app testing and deployment through high reloading features etc. And when it comes to app development, biggest concern for programmers and customers is security. As most people use mobile apps for shopping, ordering food, and money transactions, it becomes essential to secure your app. Hence here we came with some tips to secure your flutter app. Let’s have a look.
Know the latest features of Flutter 2.5 at- What’s New In Flutter 2.5 And Dart 2.14?
How To Secure Flutter Mobile Apps?
1. Secure CI Infrastructure-
You should know what’s going on in your VM’s and workflows depending on whether your CI infrastructure is self-hosted or using services like Github actions.
Updates-
So as to ensure your apps are running in a secure environment, you must keep your VMs up-to-date or be on a lookout for security vulnerabilities.
Secrets-
You should not commit API keys or related sensitive data in your code, rather you add them on secrets settings of your project. Other services such as Bitrise provide the same option to store secrets.
2. Secure Developer Identity-
Files such as keystore, keystore.properties, Google service account or any secrets that can reveal developers identity must be encrypted at all times when tracking in repository.
Create a directory and use GPG to encrypt it.
cd android
gpg --symmetric --cipher-algo AES256 android_keys.zipEncrypt sensitive files, for example, key.jks and keystore.properties
Ignore and don’t keep track of unencrypted sensitive files.
# Ignore Android keys
key.jks
key.properties
service_account_key.json
Android_keys.zip3. Secure User Data-
PII(Personally Identifiable information) is the most critical data that you don’t want to store on your apps, because unfortunately,if revealed, the company is in big trouble. But there are some cases where PII is required, for instance, for offline-first apps. Whenever required, you can use flutter_Secure_store to store PII or other sensitive data like auth token.
In short, Flutter secure storage is a package that makes use of Keystore for android and Keychains for iOS. Both of them are considered a standard in terms of security-sensitive data to user’s mobile devices.
Caching-
To store sensitive data other than PII, it will be better to use Hive for performance gain, though it needs more setup. It uses AES-256 encryption that helps you to secure the data of users from unwanted exploit or tampering.
Tip- To secure the users data, don’t store it in plain text.
4. Restrict Network Traffic-
Generally the apps are connected to the internet, whether to a third-party service provider or to their own servers. Also, the app exchange carried out on a Transport secure layer (TLS) to provide a secure connection between mobile apps and your servers.
Trusted network-
Way to restrict network traffic or connection to an unsecured endpoint is via explicitly whitelisting your domain.
For Android:
res/xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config>
<domain includeSubdomains="true">example.com</domain>
<trust-anchors>
<certificates src="@raw/my_ca"/>
</trust-anchors>
</domain-config>
</network-security-config>For iOS-
ios/Info.plist
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<false/>
<key>NSExceptionDomains</key>
<dict>
<key>cocoacasts.com</key>
<dict>
<key>NSIncludesSubdomains</key>
<true/>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
</dict>
</dict>
</dict>Certificate pinning-
Implement certificate pinning for apps to restrict the secure connection to specific certificates. It ensures that the connection between apps and servers is authentic and trusted. Without certificate pinning, hacker can eavesdrop or tamper data when on transit using hacked or self-signed certificates.
5. Secure API Keys-
There are various formats of keys, but generally it is in the form of a String. If it is not encrypted or obfuscated, it will be easier for hacker to use your API keys.
