我想固定我服务器的公钥,以便对服务器发出的任何请求都必须具有该公钥(这是为了防止像 Charles 这样的代理嗅探数据)。
我在 Android 中用 Volley 做了类似的事情。
我怎样才能用 Flutter 做同样的事情?
最佳答案
使用没有受信任根的 SecurityContext
创建您的客户端以强制执行错误的证书回调,即使是好的证书也是如此。
SecurityContext(withTrustedRoots: false);
在错误证书回调中,使用 asn1lib package 解析 DER 编码证书.例如:
ASN1Parser p = ASN1Parser(der);
ASN1Sequence signedCert = p.nextObject() as ASN1Sequence;
ASN1Sequence cert = signedCert.elements[0] as ASN1Sequence;
ASN1Sequence pubKeyElement = cert.elements[6] as ASN1Sequence;
ASN1BitString pubKeyBits = pubKeyElement.elements[1] as ASN1BitString;
List<int> encodedPubKey = pubKeyBits.stringValue;
// could stop here and compare the encoded key parts, or...
// parse them into their modulus/exponent parts, and test those
// (assumes RSA public key)
ASN1Parser rsaParser = ASN1Parser(encodedPubKey);
ASN1Sequence keySeq = rsaParser.nextObject() as ASN1Sequence;
ASN1Integer modulus = keySeq.elements[0] as ASN1Integer;
ASN1Integer exponent = keySeq.elements[1] as ASN1Integer;
print(modulus.valueAsBigInteger);
print(exponent);
关于dart - 如何在 Flutter 中进行公钥固定?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/54726406/