56 results available
Sign in
Skills directory

flutter-use-http-package

flutter

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 3.


Open before hardening

1

Low
Open after hardening

1

Low

Expand
File
Group
Subtype
Severity
Status
LICENSE

Excessive Agency & Rogue Autonomy

—

Low
Open

1 finding


SKILL.md

Implementing Flutter Networking

Contents

  • Configuration & Permissions
  • Request Execution & Response Handling
  • Background Parsing
  • Workflow: Executing Network Operations
  • Examples

Configuration & Permissions

Configure the environment and platform-specific permissions required for network access.

  1. Add the http package dependency via the terminal:
    flutter pub add http
  2. Import the package in your Dart files:
    import 'package:http/http.dart' as http;
  3. Configure Android permissions by adding the Internet permission to android/app/src/main/AndroidManifest.xml:
    <uses-permission android:name="android.permission.INTERNET" />
  4. Configure macOS entitlements by adding the network client key to both macos/Runner/DebugProfile.entitlements and macos/Runner/Release.entitlements:
    <key>com.apple.security.network.client</key>
    <true/>

Request Execution & Response Handling

Execute HTTP operations and map responses to strongly typed Dart objects.

  • URIs: Always parse URL strings using Uri.parse('your_url').
  • Headers: Inject authorization and content-type headers via the headers parameter map. Use HttpHeaders.authorizationHeader for auth tokens. Load auth tokens at runtime, for example after the user signs in, and keep them in secure platform storage; shipped app binaries can be unpacked, so keep tokens out of source code and source control. Attach credentials only to your own trusted API hosts over secure connections.
  • Timeouts: Set a timeout on every request and handle timeout and connection errors so the loading indicator stops and the user sees a failure state.
  • Payloads: For POST and PUT requests, encode the body using jsonEncode() from dart:convert.
  • Status Validation: Evaluate response.statusCode. Treat 200 OK (GET/PUT/DELETE) and 201 CREATED (POST) as success. Other statuses in the two hundred range, such as an empty no content reply, also count as success; leave an empty body undecoded.
  • Error Handling: Throw explicit exceptions for non-success status codes. Never return null on failure, as this prevents FutureBuilder from triggering its error state and causes infinite loading indicators. Show users a generic failure message and log the detailed error for developers; keep response bodies and tokens out of exception text.
  • Deserialization: Parse the raw string using jsonDecode(response.body) and map it to a custom Dart object using a factory constructor (e.g., fromJson). Treat response JSON as untrusted: catch format and type errors during parsing, rethrow a descriptive exception, and check that required fields exist with the expected types.

Background Parsing

Offload expensive JSON parsing to a separate Isolate to prevent UI jank (frame drops).

  • Import package:flutter/foundation.dart.
  • Use the compute() function to run the parsing logic in a background isolate.
  • Ensure the parsing function passed to compute() is a top-level function or a static method, as closures or instance methods cannot be passed across isolates.

Workflow: Executing Network Operations

Use the following checklist to implement and validate network operations.

Task Progress:

  • 1. Define the strongly typed Dart model with a fromJson factory constructor.
  • 2. Implement the network request method returning a Future<Model>.
  • 3. Apply conditional logic based on the operation type:
    • If fetching data (GET): Append query parameters to the URI through its query parameter support so values are encoded, rather than joining strings by hand.
    • If mutating data (POST/PUT): Set 'Content-Type': 'application/json; charset=UTF-8' and attach the jsonEncode body.
    • If deleting data (DELETE): Return an empty model instance on success (200 OK, or another status in the two hundred range).
  • 4. Validate the statusCode and throw an Exception on failure.
  • 5. Integrate the Future into the UI using FutureBuilder.
  • 6. Handle snapshot.hasData, snapshot.hasError, and default to a CircularProgressIndicator.
  • 7. Feedback Loop: Run the app -> trigger the network request -> review console for unhandled exceptions -> fix parsing or permission errors. Use only development or test endpoints and test credentials, and prefer unit tests with a mock client to check parsing and error handling before running live requests.

Examples

High-Fidelity Implementation: Fetching and Parsing in the Background

import 'dart:async';
import 'dart:convert';
import 'dart:io';
import 'package:flutter/foundation.dart';
import 'package:flutter/material.dart';
import 'package:http/http.dart' as http;

// 1. Top-level parsing function for Isolate
List<Photo> parsePhotos(String responseBody) {
  final parsed = (jsonDecode(responseBody) as List<Object?>)
      .cast<Map<String, Object?>>();
  return parsed.map<Photo>(Photo.fromJson).toList();
}

// 2. Network execution with background parsing
Future<List<Photo>> fetchPhotos() async {
  final response = await http.get(
    Uri.parse('https://jsonplaceholder.typicode.com/photos'),
    headers: {
      HttpHeaders.acceptHeader: 'application/json',
    },
  );

  if (response.statusCode == 200) {
    // Offload heavy parsing to a background isolate
    return compute(parsePhotos, response.body);
  } else {
    throw Exception('Failed to load photos. Status: ${response.statusCode}');
  }
}

// 3. Strongly typed model
class Photo {
  final int id;
  final String title;
  final String thumbnailUrl;

  const Photo({
    required this.id,
    required this.title,
    required this.thumbnailUrl,
  });

  factory Photo.fromJson(Map<String, dynamic> json) {
    return Photo(
      id: json['id'] as int,
      title: json['title'] as String,
      thumbnailUrl: json['thumbnailUrl'] as String,
    );
  }
}

// 4. UI Integration
class PhotoGallery extends StatefulWidget {
  const PhotoGallery({super.key});

  @override
  State<PhotoGallery> createState() => _PhotoGalleryState();
}

class _PhotoGalleryState extends State<PhotoGallery> {
  late Future<List<Photo>> _futurePhotos;

  @override
  void initState() {
    super.initState();
    // Initialize Future once to prevent re-fetching on rebuilds
    _futurePhotos = fetchPhotos();
  }

  @override
  Widget build(BuildContext context) {
    return FutureBuilder<List<Photo>>(
      future: _futurePhotos,
      builder: (context, snapshot) {
        if (snapshot.hasData) {
          final photos = snapshot.data!;
          return ListView.builder(
            itemCount: photos.length,
            itemBuilder: (context, index) => ListTile(
              leading: Image.network(photos[index].thumbnailUrl),
              title: Text(photos[index].title),
            ),
          );
        } else if (snapshot.hasError) {
          return Center(child: Text('Error: ${snapshot.error}'));
        }
        
        // Default loading state
        return const Center(child: CircularProgressIndicator());
      },
    );
  }
}

Image URLs in this example come from the remote response. Check that they use secure connections and point to expected hosts, and show a placeholder when an image fails to load. In production, replace the generic error text shown to users with a friendly failure message and log the detailed error for developers.

Install

Install with chainctl
chainctl skill install public/flutter/flutter-use-http-package:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/flutter/skills
Upstream commitc8df2c422c12e4feb3a1636405a71c0dd882fe18
OCI reference

skills.cgr.dev/public/github.com/flutter/skills/flutter-use-http-package:latest

License

BSD-3-Clause

Files

HARDENING.md

LICENSE

SKILL.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.