Add documentation describing how to use the Flutter engine HTTP blocking mechanism.

Dart uses sockets in order to make its HTTPS requests, which means any enforced HTTPS policies forced by the OS will be ineffective and won't work.

An app can have multiple sources that trigger an HTTP request, many of those we can't control as they can be in a third party library.

Currently we can force HTTPS only connections passing this zone configuration:

zoneValues: {#flutter.io.allow_http: false},

But this isn't documented anywhere and it's deep inside the engine, so this can be changed at any time, so it's not a strong and guaranteed solution.

I this this configuration should be documented and also we should have a higher level mechanism for configuring it.

See #69685 for origins of this flag, outlines of a plan to put it to use.

Is there any way to do this without using Zone.fork? We are using runZonedGuarded in our app, but we wanted to use PlatformDispatcher.instance.onError instead as of Flutter 3.3. However, we can't do it because we need the zoneValues: {#flutter.io.allow_http: false}, from runZonedGuarded.

From the primary triage perspective: I'm not sure which team would be suited to take this issue other than engine team.

This is a Dart issue. If this is something that is still of interest, I recommend filing it at: https://github.com/dart-lang/sdk/issues/new/choose
In the meantime I'm going to close this.

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

A Dart issue was filed at dart-lang/sdk#53929 but it isn't obvious to me that this is a Dart issue.

A quick explanation of how the current mechanism works (copied from dart-lang/sdk#53929 (comment)):

HttpClient calls _httpConnectionHook when connecting to a URL:

  Future<_HttpClientRequest> _openUrl(String method, Uri uri) {
    ...
    _httpConnectionHook(uri);
   }

Flutter Engine defines the close hook:

/// Loopback connections are always allowed.
/// Zone override with 'flutter.io.allow_http' takes first priority.
/// If zone override is not provided, engine setting is checked.
@pragma('vm:entry-point')
void Function(Uri) _getHttpConnectionHookClosure(bool mayInsecurelyConnectToAllDomains) {
  return (Uri uri) {
      final Object? zoneOverride = Zone.current[#flutter.io.allow_http];
      if (zoneOverride == true) {
        return;
      }
      if (zoneOverride == false && uri.isScheme('http')) {
        // Going to _isLoopback check before throwing
      } else if (mayInsecurelyConnectToAllDomains || uri.isScheme('https')) {
        // In absence of zone override, if engine setting allows the connection
        // or if connection is to `https`, allow the connection.
        return;
      }
      // Loopback connections are always allowed
      // Check at last resort to avoid debug annoyance of try/on ArgumentError
      if (_isLoopback(uri.host)) {
        return;
      }
      throw UnsupportedError(
        'Non-https connection "$uri" is not supported by the platform. '
        'Refer to https://flutter.dev/docs/release/breaking-changes/network-policy-ios-android.');
    };
}

And Flutter Engine installs _getHttpConnectionHookClosure here:

void DartIO::InitForIsolate(bool may_insecurely_connect_to_all_domains,
                            const std::string& domain_network_policy) {
  Dart_Handle io_lib = Dart_LookupLibrary(ToDart("dart:io"));
  Dart_Handle result = Dart_SetNativeResolver(io_lib, dart::bin::LookupIONative,
                                              dart::bin::LookupIONativeSymbol);
  FML_CHECK(!CheckAndHandleError(result));

  Dart_Handle ui_lib = Dart_LookupLibrary(ToDart("dart:ui"));
  Dart_Handle dart_validate_args[1];
  dart_validate_args[0] = ToDart(may_insecurely_connect_to_all_domains);
  Dart_Handle http_connection_hook_closure =
      Dart_Invoke(ui_lib, ToDart("_getHttpConnectionHookClosure"),
                  /*number_of_arguments=*/1, dart_validate_args);
  FML_CHECK(!CheckAndHandleError(http_connection_hook_closure));
  Dart_Handle http_lib = Dart_LookupLibrary(ToDart("dart:_http"));
  FML_CHECK(!CheckAndHandleError(http_lib));
  Dart_Handle set_http_connection_hook_result = Dart_SetField(
      http_lib, ToDart("_httpConnectionHook"), http_connection_hook_closure);
  FML_CHECK(!CheckAndHandleError(set_http_connection_hook_result));
}

If I understand the request, it is to:

provide a higher-level mechanism to control the policy enforced by _getHttpConnectionHookClosure
provide documentation

Both of those would belong as part of Flutter.

Navigation Menu

Repository navigation

Add documentation describing how to use the Flutter engine HTTP blocking mechanism. #95341

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Add documentation describing how to use the Flutter engine HTTP blocking mechanism. #95341

Description

Activity

aam commented on Dec 20, 2021

mateusfccp commented on Oct 27, 2022

huycozy commented on Oct 4, 2023

Hixie commented on Oct 10, 2023

github-actions commented on Oct 24, 2023

brianquinlan commented on Nov 7, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions