flutter_secure_storage

The web implementation of flutter_secure_storage provides:

• Secure storage using WebCrypto: Leverages the browser's native WebCrypto API for cryptographic operations.
• Application-specific key wrapping: An optional configuration to enhance security by wrapping keys.

As of version 10.0.0, the plugin uses custom cipher implementations instead of the deprecated Jetpack Security library's encryptedSharedPreferences.

Key details for Android developers:

• Default Ciphers: Uses RSA OAEP (key cipher) + AES-GCM (storage cipher).
• Minimum SDK: Requires Android SDK 23 (Android 6.0+) or higher.
• Migration: Automatic migration from old ciphers is enabled by default via migrateOnAlgorithmChange.
• Configuration: Use AndroidOptions() or AndroidOptions.biometric() to configure security settings.

The plugin requires a running keyring service at runtime. Most desktop environments provide this automatically:

• GNOME / Ubuntu: gnome-keyring (usually active by default).
• KDE: kwallet (enabled via KDE Wallet Manager).
• Other / lightweight: secret-service.

Headless / CI environments: If you are running in a headless environment or CI, you must manually start gnome-keyring-daemon with an unlocked keyring using the following commands:

eval $(dbus-launch --sh-syntax)
echo "" | gnome-keyring-daemon --unlock --daemonize --components=secrets

The Windows implementation uses a hybrid approach to ensure confidentiality and integrity of sensitive data:

1. Encryption: Values are encrypted using the AES-GCM (Galois/Counter Mode) algorithm.
2. Key Management: A unique encryption key is generated and securely stored in the Windows Credential Manager.
3. Storage: The encrypted value, a nonce, and an authentication tag are saved to a file in the application's support directory. Files are named after the key with a .secure extension.
4. Isolation: The storage directory is dynamically determined based on the application's context to prevent unauthorized access.
5. Backward Compatibility: The plugin can also store and retrieve data directly from the Windows Credential Manager if required.

To build and run flutter_secure_storage on Linux, you need the following:

1. Build-time: libsecret-1-dev
2. Run-time: libsecret-1-0
3. Keyring Service: Either gnome-keyring (Gnome) or kwalletmanager (KDE).

If using Snapcraft to build, include these in your part configuration:

parts:
  uet-lms:
    source: .
    plugin: flutter
    flutter-target: lib/main.dart
    build-packages:
      - libsecret-1-dev
    stage-packages:
      - libsecret-1-0

To run the demonstration application, follow these steps from your terminal:

1. Navigate to the example directory.
2. Install the necessary dependencies: flutter pub get.
3. Launch the application: flutter run.

Note: You must have an iOS or Android emulator or a physical device configured to run the app.

cd example
flutter pub get
flutter run

Add flutter_secure_storage to your pubspec.yaml dependencies and run flutter pub get.

Important: Before interacting with the MethodChannel (e.g., initializing the storage instance), you must call WidgetsFlutterBinding.ensureInitialized() in your main() function.

dependencies:
  flutter_secure_storage: ^<latest_version>

flutter pub get

To run the integration tests for the Linux implementation, use xvfb-run to provide a virtual display:

cd flutter_secure_storage/example
xvfb-run flutter test integration_test/linux_test.dart -d linux

To use flutter_secure_storage on Linux, you must install the libsecret library. You need both the development package for building the application and the runtime package for running it.

Ubuntu / Debian-based (Linux Mint, Pop!_OS, etc.):

sudo apt install libsecret-1-0 libsecret-1-dev

Fedora / RHEL / CentOS:

sudo dnf install libsecret libsecret-devel

Arch-based:

sudo pacman -S libsecret