feat(auth): allow connecting to servers with self-signed certificates#1232
Open
bhavit04 wants to merge 1 commit into
Open
feat(auth): allow connecting to servers with self-signed certificates#1232bhavit04 wants to merge 1 commit into
bhavit04 wants to merge 1 commit into
Conversation
Self-hosted instances served behind a self-signed (or otherwise invalid) TLS certificate could not be reached from the app: both the API client and image loading failed certificate validation. Add an opt-in "Allow self-signed certificates" toggle to the advanced sign-in sheet, shown only when a self-hosted server is selected. When enabled it installs an HttpOverrides.global that skips certificate validation, which transparently covers the http-package API client and the dart:io HttpClient used by NetworkImage / extended_image. The preference is persisted in AppSettings and re-applied on startup before the first request, and applied immediately when toggled so the next login already trusts the certificate. The override is a no-op on web, where dart:io networking does not apply. Native media players (the video_player plugin) use their own networking stack and are not affected by this override. Closes wger-project#116 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
|
that's probably a better (the only) solution in our case. I've moved this to the next version planning so it doesn't get lost 👍🏻 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use case
Closes #116.
Self-hosted wger instances served behind a self-signed (or otherwise invalid) TLS certificate currently can't be reached from the app — both API calls and image loading fail certificate validation, so users can't even view exercise images.
Changes
HttpOverrides.global(WgerHttpOverrides) that skips certificate validation. Because it's a globaldart:iooverride, it transparently covers both thehttp-package API client and theHttpClientused byNetworkImage/extended_imagefor images — no per-call plumbing needed.AppSettings(PreferenceHelper/SharedPreferences), re-applied on startup inmain()before the first network request (auto-login probe), and applied immediately when toggled so the very next login already trusts the certificate.dart:ionetworking /HttpOverridesdoesn't apply (kIsWebguard).The toggle's subtitle warns that it disables TLS validation and should only be used for a trusted server, and it defaults to off.
Known limitation
Native media players (the
video_playerplugin on Android/iOS) use their own networking stack and are not affected byHttpOverrides. Streaming exercise videos from a self-signed host would additionally need native config (Androidnetwork_security_config.xml, iOS ATS); that's intentionally left out of this PR to keep it focused on the connectivity + image path. Happy to follow up with a separate PR if wanted.Testing
flutter analyze— no issues.test/core/settings_test.dart) and the override helper (test/helpers/http_overrides_test.dart).test/auth/auth_screen_test.dart).json_test.darttimezone case also fails on a cleanmasterand is unrelated).🤖 Generated with Claude Code