search

mogol / flutter_secure_storage

A Flutter plugin to store data in secure storage
https://pub.dartlang.org/packages/flutter_secure_storage
BSD 3-Clause "New" or "Revised" License
1.09k stars 340 forks source link

Can you add support for 0.0.0.0 IP? #665

Open jvv-g39 opened 5 months ago

jvv-g39 commented 5 months ago

When I am running the flutter debug web app in Chrome at IP 0.0.0.0 to test it in mobile browser the flutter_secure_storage is not working. It is throwing the error JSNoSuchMethodError (TypeError: Cannot read properties of undefined (reading 'generateKey')). I found that it works only in localhost or with HTTPS. Why is there this limitation? Is there a way to enable running it in 0.0.0.0 IP address? We would want to run in other local IP ranges like 192.168.1.x etc. Thanks.

rekire commented 5 months ago

So you want to access that unencrypted via plain http without transport encryption? I think out of security you should simply not do that. It is not really hard to setup a https server.

jsloop42 commented 5 months ago

From what I understand I am using this package to write data encrypted. On web it stores that in local storage encrypted. I want to test the website on my mobile browser connected to the debug server to fix some UI issues. It is not practical to build the web app and deploy to local https server for each change I make. This is for debugging only. Having an option to whitelist IP addresses would be nice. When running in production I am using HTTPS. I don't see how this is insecure because be it HTTP or HTTPS the data stored in the localstore is encrypted by the package and I need to call the package API to get the data which is decrypted for read. Could you please elaborate on this, what I am missing?

Anyway, I found that the option to run Flutter debug server with TLS certs was added to master branch recently. Got certs generated and I was able to test the flutter web app locally on the mobile device browser by running the debug server with HTTPS. Had to spend a couple of hours to configure all these.

rekire commented 5 months ago

From https://github.com/mogol/flutter_secure_storage/issues/320#issuecomment-976308930:

After some searching it seems that webCrypto only works when the site is running HTTPS or localhost. How are you running your build?

Source: ipfs/js-ipfs#964 (comment)