Flutter SafetyNet Attestation plugin for Android

What is SafetyNet?

The SafetyNet Attestation API helps you assess the security and compatibility of the Android environments in which your apps run. You can use this API to analyze devices that have installed your app.'

Please check the documentation here.

Getting Started

iOS

The plugin won't work iOS, because SafetyNet is only available for Android devices.

Android

  1. Open the Google APIs console and enable Android Device Verification API
  2. Create your API key
  3. In your Android project, please add the SafetyNet API key in your AndroidManifest.xml:
<meta-data android:name="safetynet_api_key"
            android:value="yourapikey"/>

Dart

The SafetyNet API is requiring a working version of the Google Play Services. A method is available to check if they are available on the device:

FlutterSafetynetAttestation.googlePlayServicesAvailability();

Then you have to pass a nonce (in a String or a byte array) to the following method:

FlutterSafetynetAttestation.safetyNetAttestationJwt('<your-nonce>');

It will then return a JWT string. Google recommends to check this JWT on your server. Please read the official documentation for more details.

If you want to get directly the payload from the JWT string, you can call instead:

FlutterSafetynetAttestation.safetyNetAttestationPayload('<your-nonce>');

You will then receive a JWSPayload object with this kind of content:

{
  "nonce": "R2Rra24fVm5xa2Mg",
  "timestampMs": 9860437986543,
  "apkPackageName": "com.package.name.of.requesting.app",
  "apkCertificateDigestSha256": ["base64 encoded, SHA-256 hash of the
                                  certificate used to sign requesting app"],
  "apkDigestSha256": ["base64 encoded, SHA-256 hash of
                      the APK installed on a user's device"],
  "ctsProfileMatch": true,
  "basicIntegrity": true,
}

Libraries

flutter_safetynet_attestation

Dart

dart:ui
Built-in types and core primitives for a Flutter application. [...]

Core

dart:async
Support for asynchronous programming, with classes such as Future and Stream. [...]
dart:collection
Classes and utilities that supplement the collection support in dart:core. [...]
dart:convert
Encoders and decoders for converting between different data representations, including JSON and UTF-8. [...]
dart:core
Built-in types, collections, and other core functionality for every Dart program. [...]
dart:developer
Interact with developer tools such as the debugger and inspector. [...]
dart:math
Mathematical constants and functions, plus a random number generator. [...]
dart:typed_data
Lists that efficiently handle fixed sized data (for example, unsigned 8 byte integers) and SIMD numeric types. [...]

VM

dart:io
File, socket, HTTP, and other I/O support for non-web applications. [...]
dart:isolate
Concurrent programming using isolates: independent workers that are similar to threads but don't share memory, communicating only via messages. [...]