isCertificateFingerprintAllowed function
- X509Certificate? certificate, {
- required List<
String> allowedFingerprints,
Whether certificate matches one of allowedFingerprints.
Takes the fingerprint list as a parameter (rather than reading SecurityConstants directly) so it can be unit tested against arbitrary fingerprint lists without needing to override a compile-time constant.
The empty-list and null-certificate cases both fail open (allow) rather than fail closed — this is a deliberate, security-reviewed decision, not an oversight: there is no production release yet, fail-open avoids the app being entirely non-functional pre-launch, and both cases remain fully protected by the platform's normal TLS/system-CA trust regardless. Do not "fix" this to fail closed without first raising it as a discussion, since it has already been decided.
Implementation
bool isCertificateFingerprintAllowed(X509Certificate? certificate, {required List<String> allowedFingerprints}) {
if (allowedFingerprints.isEmpty || certificate == null) {
return true;
}
final String fingerprint = sha256.convert(certificate.der).toString().toUpperCase();
final List<String> normalizedAllowed = allowedFingerprints
.map((String f) => f.toUpperCase().replaceAll(RegExp(r'[:\s]'), ''))
.toList(growable: false);
return normalizedAllowed.contains(fingerprint);
}