Skip to content

FlutterFlow Integration

Jump to bottom
Jaroslav Novotný edited this page Aug 10, 2023 · 8 revisions

This page provides you all necessary information about freeRASP integration for FlutterFlow. Please read it carefully. If you have question, don't hesitate to open an issue.

Integrating freeRASP

In this section, you will implement the imported freeRASP Action.

  1. On your app's initial page, navigate to the UI Builder.
  2. On the right panel, click on Actions.
  3. In the Action Flow Editor box, click Open.
  4. In the newly opened window, click on On Page Load at the top.
  5. Click Add Action (or + and then Add Action, if you already have an Action).
  6. On the right panel, search for the runRASP Custom Action.
  7. Select the runRASP Action.

ℹ️ In the Set Function Arguments section, you will find the configuration related arguments and several "onX" arguments. More about reactions in Handling threats section.

Providing configuration

The freeRASP Action requires several arguments to be filled to function. Some data are related to specific platforms.

If you are developing the application exclusively for one platform, you can omit the configuration part related to the other platform. If you don't want to provide configuration to unrelated platform, provide an empty string:

  1. Click orange variable icon next to Value label
  2. Scroll down to Constants
  3. Click Constant to expand dropdown menu
  4. Select Empty String

Configuration parameters

watcherMail

watcherMail is an email address designated for receiving security reports. Ensure that the email address follows the strict [email protected] format.

isProd

isProd is a boolean flag that determines whether the freeRASP integration is in dev or release version.

The Dev version of freeRASP is intended for usage during the development phase. It serves the purpose of segregating development and production data, as well as disabling certain checks that are not applicable during the development process. These checks include:

  • Emulator usage (onSimulator)
  • Debugging (onDebug)
  • Signing (onAppIntegrity)
  • Unofficial store (onUnofficialStore)

[Android] packageName

`packageName`` is a unique identifier for your Android application.

You can find `packageName`` value for your application in FlutterFlow settings:

  1. Navigate to Settings and Integrations.
  2. Locate and select App Details.
  3. In the textbox labeled Package Name, you will find the package name associated with your application.

❗️ Do NOT use solutions such as package_info_plus to provide value of package name! Package name has to be hardcoded.

[Android] signingCertHash

signingCertHash is a hash of the certificate of the key which was used to sign the application.

⚠️ Value of hash must be encoded in Base64 form. ⚠️

More about signing hash and how to obtain it: GitHub Wiki Page | Getting Signing Certificate Hash.

[Android] supportedStore (optional)

supportedStore is a third-party app store to which your application is uploaded. By including this store, freeRASP considers it as trusted source.

To add a store, add the package name of the store to the supportedStore list.

💡 Google Play store and Huawei AppGallery are supported out of the box. You don't need to add them.

[iOS] bundleId

bundleId is a unique identifier for your iOS application.

More about bundle ID and how to obtain one: FlutterFlow Documentation | App Deployment.

[iOS] teamId

teamId is a unique identifier assigned to a development team enrolled in the Apple Developer Program.

You can find your teamId on the Apple Developer portal:

  1. Go to the website: https://developer.apple.com/account.
  2. Log in using the account that is used to sign and release your app.
  3. Scroll down to the Membership details section.
  4. Look for the line labeled "Team ID" - the value of your teamId will be displayed there.

Handling threats

The freeRASP Action offers multiple callbacks for handling threats. A callback is an Action that gets triggered when a threat is detected.

To implement callback:

  1. Open Action Flow Editor with runRASP action.
  2. Open one of dropdown menus labeled "onX" on the right panel (X for given type of reaction, for example onAppIntegrity)
  3. In the Action Flow Editor box, click on Open.
  4. Implement your reaction.

Visit our GitHub Wiki Page | Threat Detection to learn more details about the performed checks and their importance for app security.

Security Report

The Security Report is a weekly summary describing the application's security state and characteristics of the devices it runs on in a practical and easy-to-understand way.

The report provides a quick overview of the security incidents, their dynamics, app integrity, and reverse engineering attempts. It contains info about the security of devices, such as OS version or the ratio of devices with screen locks and biometrics. Each visualization also comes with a concise explanation.

Example of security report

User Data Policies

See the generic information about freeRASP data collection here.

Google Play requires all app publishers to declare how they collect and handle user data for the apps they publish on Google Play. They should inform users properly of the data collected by the apps and how the data is shared and processed. Therefore, Google will reject the apps which do not comply with the policy.

Apple has a similar approach and specifies the types of collected data.

You should also visit our Android and iOS submodules to learn more about their respective data policies.

Limitations

Limited configuration

freeRASP for Flutter allows you to define multiple values for:

  • Signing certificate hash
  • Supported app store
  • Bundle ID

Due to FlutterFlow's limitations, the current implementation of freeRASP for FlutterFlow only allows you to specify a single value for each of these attributes. If want to provide more values, you can download the code and adjust those parameters manually (see freeRASP for Flutter | README.md)

Mobile support only

Currently, freeRASP supports only Android and iOS. When running the application in the FlutterFlow web client, freeRASP will not be initialized.

[Android] Minimal SDK level

The minimum required Android SDK level for freeRASP is 23. FlutterFlow applications have a minimum SDK level of 21 by default.

This creates some restrictions:

  • Deploying the application from the FlutterFlow web client is not possible.
  • Downloading the APK from the FlutterFlow web client is not supported.

To overcome these limitations, we recommend following these steps:

  1. Download the code.
  2. Manually raise the SDK level in the build.gradle file to 23.
  3. Deploy application using Google Play Console.

Raising SDK version

  1. From root of your project, go to android > app > build.gradle
  2. In defaultConfig update minSdkVersion to at least 23 (Android 6.0) or higher
android {
...
defaultConfig {
    ...
    minSdkVersion 23
    ...
    }
...
}
Clone this wiki locally