dpop_flutter_http #

package:http integration for dpop_flutter - attaches DPoP Authorization/DPoP headers to every request and retries once on a DPoP-Nonce challenge.

dpop_flutter's core has no dependency on package:http (or any HTTP client); this adapter is the optional glue between the two.

Installation #

dependencies:
  dpop_flutter: ^0.1.0
  dpop_flutter_http: ^0.1.0

Usage #

import 'package:dpop_flutter/dpop_flutter.dart';
import 'package:dpop_flutter_http/dpop_flutter_http.dart';

final dpop = DpopClient(keyStore: SecureDpopKeyStore());
await dpop.initialize();

final client = DpopHttpClient(dpop: dpop, tokenProvider: myTokenProvider);
final response = await client.get(Uri.parse('https://api.example.com/profile'));

DpopHttpClient is a normal http.BaseClient - get/post/put/patch/ delete/head/send all work as usual; it just adds two headers to every outgoing request.

Nonce retry #

On a 401 response carrying a DPoP-Nonce header, the client stores the nonce, builds a brand-new proof, and retries exactly once. This only applies to non-streaming requests (http.Request); streamed/multipart request bodies can't be safely re-sent and are returned as-is without a retry. Any response (not just 401s) that carries a DPoP-Nonce header has its nonce recorded proactively for the next request to that origin.

Without the wrapper #

You don't need DpopHttpClient at all - dpop_flutter's core is enough:

final headers = await dpop.createHeaders(method: 'GET', uri: uri, accessToken: token);
final response = await http.get(uri, headers: headers);

See the main dpop_flutter README for the full DPoP overview, security model, and nonce/rotation/multi-account guidance.

Contributing #

Issues and PRs are welcome - see CONTRIBUTING.md in the repo for setup, workflow, and what a PR should include, and CODE_OF_CONDUCT.md. Found a security issue? Please don't open a public issue - see SECURITY.md instead.