Unable to handle HTTPS traffic for some Flutter applications

[cxplay]

Please answer the following questions for yourself before submitting a question.

• I am running the latest version
• I checked the knowledge base and found no answer
• I checked to make sure that this issue has not already been filed

Ask a question

I testing use AdGuard with Boorusama (a web gallery client) on Android:

https://github.com/khoadng/Boorusama

It doesn't have SSL pinning, but I can't handle his HTTPS traffic through AdGuard (VPN mode, v4.6.3).
I'm using other HTTPS analysis tools to monitor traffic just fine, is there something I'm missing here?

[maxikuzmin]

@cxplay some apps don't trust third-party certificates. We have contacted Boorusama app support to clarify about this. Please wait

[maxikuzmin]

@cxplay Boorusama app doesn't implement SSL pinning. HTTPS filtering is unfortunately not possible

[cxplay]

@cxplay Boorusama app doesn't implement SSL pinning. HTTPS filtering is unfortunately not possible

But why? If there is no SSL pinning, why can't AdGuard filter it?

[maxikuzmin]

@cxplay HTTPS filtering is not possible for an application that does not trust third-party certificates

[cxplay]

@cxplay HTTPS filtering is not possible for an application that does not trust third-party certificates

No, this is wrong. Boorusama trusts system certificates, whether third-party or not. You should try to verify this with some HTTP(s) debugging tools:

https://github.com/wanghongenpin/network_proxy_flutter

It's just that AdGuard can't handle HTTPS traffic for that application.

[maxikuzmin]

@cxplay developer Boorusama replied to me that the app doesn't implement SSL pinning

[cxplay]

@cxplay developer Boorusama replied to me that the app doesn't implement SSL pinning

I know, I knew it from the beginning. My question is, why can't AdGuard filter HTTPS traffic for Flutter apps that most HTTPS debugging tools can catch?

[cxplay]

This has little to do with SSL pinning, and is only mentioned as a supplement.

[cxplay]

Another example of the same problem.

https://github.com/mu-fazil-vk/FluxTube (A YouTube client using piped API)

[cxplay]

This is likely related to the popular HTTP client implementation of dio in the Flutter, which AdGuard doesn't seem to be able to handle requests from.

[maxikuzmin]

@cxplay please clarify, do you have Root on your device?

[cxplay]

@cxplay please clarify, do you have Root on your device?

Yes, I have.

[maxikuzmin]

@cxplay we need a little more time to figure this out, please wait

[cxplay]

@cxplay we need a little more time to figure this out, please wait

I'm always waiting!

[maxikuzmin]

@cxplay thanks for waiting! I was able to reproduce this issue on my device, and have passed the logs to the development team. We need some more time, please wait

[cxplay]

@cxplay thanks for waiting! I was able to reproduce this issue on my device, and have passed the logs to the development team. We need some more time, please wait

Glad to hear that!