Is a SSL certificate still needed in a Flutter webview?

Issue

We currently have an Angular web app created for an online ordering utility. But we want to create a native app out of it, and we wanted to use Flutter.

At first, though we just want to use a webview to show the existing Angular app through there.

The problem is, we wanted to do this because we also wanted to get rid of the need for an SSL certificate to access the app through a phone.

Is it still necessary to have an SSL certificate for a webview?

I imagine it is because it's still like accessing the webpage afterall, but I wanted to be sure.

Solution

The webview_flutter plugin hasn't any option to ignore SSL errors. Instead, using my flutter_inappwebview plugin, it is very simple to ignore SSL errors as you would normally do on Android, that is using the onReceivedServerTrustAuthRequest event and returning ServerTrustAuthResponse(action: ServerTrustAuthResponseAction.PROCEED); for the specified request or for all requests.

A simple example using the latest version 5.0.5+3 and https://badssl.com/ (that is a site for testing clients against bad SSL configs, see https://github.com/chromium/badssl.com) is:

child: InAppWebView(
  initialUrlRequest: URLRequest(
      url: Uri.parse("https://self-signed.badssl.com/")
  ),
  onReceivedServerTrustAuthRequest: (controller, challenge) async {
    print(challenge);
    return ServerTrustAuthResponse(action: ServerTrustAuthResponseAction.PROCEED);
  },
),

where the challenge argument provides all the information about the challenge, such as host, protocol, realm, etc.

Also, on Android, when you return the action to be taken (PROCEED or CANCEL), this decision is saved by Android itself, so the next time you go to the same URL, the onReceivedServerTrustAuthRequest event won't be triggered. In that case, you can use the controller.android.clearSslPreferences() method to clear the Android SSL preferences.

Answered By - Lorenzo Pichilli