configureCertificatePinning function

void configureCertificatePinning(
  1. Dio dio, {
  2. List<String> allowedFingerprints = SecurityConstants.allowedSHA256Fingerprints,
})

Configures SSL certificate pinning on dio via IOHttpClientAdapter.validateCertificate.

Validates the server's certificate against SecurityConstants.allowedSHA256Fingerprints inline, during the request's own TLS handshake. This is layered on top of — not instead of — the platform's normal certificate-chain trust validation: IOHttpClientAdapter.validateCertificate is only invoked once the OS/SecurityContext has already accepted the chain, so this never disables system CA trust.

A null certificate (a non-TLS response) has nothing to pin against and is allowed through unchanged. An empty SecurityConstants.allowedSHA256Fingerprints list means pinning isn't configured yet, so every certificate is allowed.

A fingerprint mismatch surfaces to callers as a Dio-thrown DioException.badCertificate, which AppExceptionMappingInterceptor maps to CertificatePinningException — unchanged from the previous interceptor-based implementation.

Call once per Dio client, right after construction:

final dio = Dio(baseOptions);
configureCertificatePinning(dio);

Implementation

void configureCertificatePinning(Dio dio, {List<String> allowedFingerprints = SecurityConstants.allowedSHA256Fingerprints}) {
  dio.httpClientAdapter = IOHttpClientAdapter(
    validateCertificate: (X509Certificate? certificate, String host, int port) =>
        isCertificateFingerprintAllowed(certificate, allowedFingerprints: allowedFingerprints),
  );
}