{"id":19645811,"url":"https://github.com/approov/quickstart-flutter-graphql","last_synced_at":"2025-04-28T14:32:59.434Z","repository":{"id":46073608,"uuid":"311314008","full_name":"approov/quickstart-flutter-graphql","owner":"approov","description":"Approov integration quickstart for Flutter with GraphQL","archived":false,"fork":false,"pushed_at":"2025-02-25T10:16:57.000Z","size":420,"stargazers_count":6,"open_issues_count":0,"forks_count":1,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-04-05T09:11:15.493Z","etag":null,"topics":["android","approov","approov-integration","approov-mobile","approov-mobile-quickstart","approov-quickstart","dart","flutter","ios","mobile","mobile-api","mobile-api-security","mobile-security"],"latest_commit_sha":null,"homepage":"https://approov.io","language":"Dart","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/approov.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-11-09T11:15:55.000Z","updated_at":"2025-02-25T10:17:01.000Z","dependencies_parsed_at":"2023-12-22T14:31:38.115Z","dependency_job_id":"52b199c4-3e2d-4164-aeaf-1a6cc1e50499","html_url":"https://github.com/approov/quickstart-flutter-graphql","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fquickstart-flutter-graphql","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fquickstart-flutter-graphql/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fquickstart-flutter-graphql/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/approov%2Fquickstart-flutter-graphql/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/approov","download_url":"https://codeload.github.com/approov/quickstart-flutter-graphql/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251330564,"owners_count":21572309,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","approov","approov-integration","approov-mobile","approov-mobile-quickstart","approov-quickstart","dart","flutter","ios","mobile","mobile-api","mobile-api-security","mobile-security"],"created_at":"2024-11-11T14:35:28.209Z","updated_at":"2025-04-28T14:32:54.366Z","avatar_url":"https://github.com/approov.png","language":"Dart","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Approov Quickstart: Flutter GraphQL\n\n[Approov](https://approov.io) is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps.\n\nThis is an Approov integration quickstart for using Flutter with GraphQL, specifically a Dart client for GraphQL subscriptions via [Absinthe](http://absinthe-graphql.org/) sockets. Additionally, a step-by-step tutorial guide using a [Todo App](https://github.com/approov/quickstart-flutter-graphql/blob/master/TODO-APP.md) is also available.\n\nThis package requires Flutter 3 because of the need to execute channel handlers on [background threads](https://docs.flutter.dev/development/platform-integration/platform-channels?tab=ios-channel-objective-c-tab#executing-channel-handlers-on-background-threads), which is only available in the stable channel from Flutter 3.\n\nNote that the minimum OS requirement for iOS is 12 and for Android the minimum SDK version is 21 (Android 5.0). You cannot use Approov in apps that need to support OS versions older than this.\n\n## ADDING APPROOV ENABLED FLUTTER GRAPHQL\n\nApproov Enabled Flutter GraphQL is available via a [`Github`](https://github.com/approov/approov-flutter-packages.git) package. This allows inclusion into the project by simply specifying a dependency in the `pubspec.yaml` files for the app. In the `dependencies:` section of `pubspec.yaml` file add the following package reference:\n\n```yaml\nabsinthe_socket:\n  git:\n    url: https://github.com/approov/approov-flutter-packages.git\n    path: absinthe_socket\napproov_service_flutter_httpclient:\n  git: https://github.com/approov/approov-service-flutter-httpclient.git\n```\n\nNote that this creates a dependency on the latest version of the `approov-service-flutter-httpclient`, as do the dependencies in `approov-flutter-packages`. If you wish to create a dependency on a fixed tagged version you can use a syntax such as the following:\n\n```yaml\napproov_service_flutter_httpclient:\n  git:\n    url: https://github.com/approov/approov-service-flutter-httpclient.git\n    ref: 3.2.0\n```\n\nYou will need to fork the `approov-flutter-packages` if you wish to fix their dependency to a specific tag.\n\nThe `absinthe_socket` package uses a predefined header to forward the Approov Token and also forwards the Approov SDK initialization string to the `approov_web_socket` package by using a `PhoenixChannel` socket. The `approov_web_socket` package interacts with the `approov_service_flutter_httpclient` by means of an `ApproovHttpClient` object.\n\nThe `approov_service_flutter_httpclient` package is actually an open source wrapper layer that allows you to easily use Approov with `Flutter`. This has a further dependency to the closed source [Android Approov SDK](https://github.com/approov/approov-android-sdk) and [iOS Approov SDK](https://github.com/approov/approov-ios-sdk) packages. Those are automatically added as dependencies for the platform specific targets.\n\nThe `approov_service_flutter_httpclient` package provides a number of accessible classes:\n\n1. `ApproovService` provides a higher level interface to the underlying Approov SDK\n2. `ApproovException`, and derived `ApproovNetworkException` and `ApproovRejectionException`, provide special exception classes for Approov related errors \n3. `ApproovHttpClient` which is a drop-in replacement for the Dart IO library's `HttpClient` and calls the `ApproovService`\n4. `ApproovClient` which is a drop-in replacement for Client from the Flutter http package (https://pub.dev/packages/http) and internally uses an `ApproovHttpClient` object\n\n### ANDROID MANIFEST CHANGES\n\nThe following app permissions need to be available in the manifest of your application to be able to use Approov:\n\n```xml\n\u003cuses-permission android:name=\"android.permission.ACCESS_NETWORK_STATE\" /\u003e\n\u003cuses-permission android:name=\"android.permission.INTERNET\" /\u003e\n```\n\nPlease [read this](https://approov.io/docs/latest/approov-usage-documentation/#targetting-android-11-and-above) section of the reference documentation if targetting Android 11 (API level 30) or above.\n\n### IOS\n\nThe `approov_service_flutter_httpclient` generates a [Cocoapods](https://cocoapods.org) dependency file which must be installed by executing:\n\n```Bash\npod install\n```\n\nin the directory containing the ios project files.\n\n### USING APPROOV FOR GRAPHQL REQUESTS\n\nApproov provides a drop in replacement for the Flutter native Http Client. Here is an example of how it can be used in initialization for a the GraphQL client in the `HttpLink`:\n\n```Dart\nimport 'dart:io';\nimport 'package:flutter/material.dart';\nimport 'package:graphql_flutter/graphql_flutter.dart';\nimport 'package:approov_service_flutter_httpclient/approov_service_flutter_httpclient.dart';\n\nstatic String _userAuthToken;\nstatic String apiBaseUrl = 'YOUR_API_SERVER_BASE_URL_HERE';\nstatic final approovClient = ApproovClient('\u003center-your-config-string-here\u003e');\nfinal HttpLink httpLink = HttpLink(\n    uri: apiBaseUrl,\n    httpClient: approovClient\n);\nfinal AuthLink authLink = AuthLink(\n  getToken: () async =\u003e _userAuthToken,\n);\nfinal Link link = authLink.concat(httpLink);\n\nstatic ValueNotifier\u003cGraphQLClient\u003e initializeClient(String token) {\n    _userAuthToken = token;\n    ValueNotifier\u003cGraphQLClient\u003e client = ValueNotifier(\n      GraphQLClient(\n        cache: OptimisticCache(dataIdFromObject: typenameDataIdFromObject),\n        link: link,\n      ),\n    );\n    return client;\n}\n```\n\nThe `\u003center-your-config-string-here\u003e` is a custom string that configures your Approov account access. This will have been provided in your Approov onboarding email.\n\n## USING APPROOV FOR GRAPHQL SUBSCRIPTIONS\n\nYou may also need to instantiate the `AbsintheSocket` with an additional parameter in order to support Approov in GraphQL subscriptions over web sockets:\n\n```Dart\n_socket = AbsintheSocket(\n      Config.websocketUrl,\n      \"\u003cyour config string here\u003e\",\n      socketOptions: AbsintheSocketOptions(\n          params: {\"Authorization\": Config.auth_token}),\n    );\n```\n\n## CHECKING IT WORKS\n\nInitially you won't have set which API domains to protect, so the interceptor will not add anything. It will have called Approov though and made contact with the Approov cloud service. You will see logging from Approov saying `UNKNOWN_URL`.\n\nYour Approov onboarding email should contain a link allowing you to access [Live Metrics Graphs](https://approov.io/docs/latest/approov-usage-documentation/#metrics-graphs). After you've run your app with Approov integration you should be able to see the results in the live metrics within a minute or so. At this stage you could even release your app to get details of your app population and the attributes of the devices they are running upon.\n\n## NEXT STEPS\n\nTo actually protect your APIs and/or secrets there are some further steps. Approov provides two different options for protection:\n\n* [API PROTECTION](https://github.com/approov/quickstart-flutter-httpclient/blob/master/API-PROTECTION.md): You should use this if you control the backend API(s) being protected and are able to modify them to ensure that a valid Approov token is being passed by the app. An [Approov Token](https://approov.io/docs/latest/approov-usage-documentation/#approov-tokens) is short lived crytographically signed JWT proving the authenticity of the call.\n\n* [SECRETS PROTECTION](https://github.com/approov/quickstart-flutter-httpclient/blob/master/SECRETS-PROTECTION.md): This allows app secrets, including API keys for 3rd party services, to be protected so that they no longer need to be included in the released app code. These secrets are only made available to valid apps at runtime.\n\nNote that it is possible to use both approaches side-by-side in the same app.\n\nSee [REFERENCE](https://github.com/approov/quickstart-flutter-httpclient/blob/master/REFERENCE.md) for a complete list of all of the `ApproovService` methods.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fquickstart-flutter-graphql","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fapproov%2Fquickstart-flutter-graphql","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapproov%2Fquickstart-flutter-graphql/lists"}