contextFor method

  1. @override
SecurityContext? contextFor(
  1. String? host
)

The certificate context for host (the SNI hostname), or null if none is available yet. Called synchronously during the TLS handshake, so it must not block; dynamic providers may kick off background provisioning and return null (or a default) for now.

Implementation

@override
SecurityContext? contextFor(String? host) {
  if (host == null) return _default;
  final normalized = host.toLowerCase();
  final cached = _contexts[normalized];
  if (cached != null) return cached;
  // Unknown host: provision in the background for next time. The allow-check
  // is async, so it cannot run here (SNI resolution must be synchronous) —
  // `obtain` performs it. `_denied` keeps a rejected host from re-invoking
  // the policy on every handshake. Swallow errors (e.g. a throwing email
  // resolver) so they never surface as an unhandled async error mid-handshake.
  if (!_inFlight.containsKey(normalized) && !_denied.contains(normalized)) {
    unawaited(obtain(normalized).catchError((Object _) => false));
  }
  return _default;
}