app_device_integrity_plus 1.0.0

Flutter plugin for App Attest and Play Integrity with real challenge (nonce) support. Replaces static dummy nonce with server-generated values.

App Device Integrity Plus

🇺🇸 English

Why?

What This Fork Fixes

The original app_device_integrity had a critical issue:

• The challengeString (nonce) sent from Flutter was completely ignored.

• The plugin always used a static Base64.encode(ByteArray(40)) value.

• This produced the well-known "AAAAAAAAAAAA..." nonce in Play Integrity logs.

• Real server-side verification was not possible because the nonce never matched.

Fixes in This Version

This fork fixes all of that.

• Proper nonce passthrough from Flutter → Native → Play Integrity

• Removed static dummy nonce (ByteArray(40))

• Added proper MethodChannel argument handling

• Updated API to accept challengeString exactly as given

• Real attestation with server-side validation now works

• README rewritten for clarity

• Additional flow diagram for easier understanding

🚀 How to Use

1. Request nonce from your backend

Your server must generate a unique challenge per session.

final sessionId = await api.getNonce();

2. Pass nonce into the plugin

final integrity = AppDeviceIntegrityPlus();

if (Platform.isAndroid) {
  final token = await integrity.getAttestationServiceSupport(
    challengeString: sessionId,
    gcp: 523725941100,
  );
} else {
  final token = await integrity.getAttestationServiceSupport(
    challengeString: sessionId,
  );
}

3. Send token to backend for validation

await api.verifyIntegrity(token);

📊 Attestation Flow (App ↔ API Server ↔ Google)

sequenceDiagram
    participant APP
    participant API as API Server
    participant GOOGLE as Google Server

    APP->>API: Request nonce
    API-->>APP: Issue nonce (server-generated value)
    APP->>GOOGLE: Call Play Integrity API (with nonce)
    GOOGLE-->>APP: Return signed token (JWT)
    APP->>API: Send token for verification
    
    note right of API: Backend verification begins
    
    API->>API: 1. Verify JWT signature using cached Google public keys
    API->>API: 2. Decode token payload
    API->>API: 3. Validate nonce, timestamp, package name, etc.
    
    note right of API: Verification complete
    
    API-->>APP: OK (trusted device/app) or Error

📚 References

• https://developer.android.com/google/play/integrity/overview
• https://developer.android.com/google/play/integrity/standard

🇰🇷 한국어

🔧 왜 만들게 되었는가?

원본 app_device_integrity 플러그인의 문제

• Flutter에서 넘긴 challengeString(nonce)을 전혀 사용하지 않음
• 내부에서 항상 ByteArray(40) → Base64 인코딩한 값 사용
• 그래서 Play Integrity 로그에 "AAAAAAAAAA..." nonce만 출력됨
• 서버 검증 시 nonce 불일치 → 정상적인 보안 검증 불가능

✅ 이 버전에서 수정 / 개선된 내용

이 포크는 이 문제를 전부 해결합니다.

• 서버에서 받은 nonce를 그대로 Play Integrity에 전달

• 더 이상 static dummy nonce 사용하지 않음

• MethodChannel 파라미터 처리 수정

• Android/iOS에서 실제 nonce 기반 토큰 생성 가능

• README 전면 재작성

• 플로우 다이어그램 추가
  

🚀 사용 방법

1. 서버에서 nonce 발급

final sessionId = await api.getNonce();

2. 플러그인에 nonce 전달

final integrity = AppDeviceIntegrityPlus();

if (Platform.isAndroid) {
  final token = await integrity.getAttestationServiceSupport(
    challengeString: sessionId,
    gcp: 523725941100,
  );
} else {
  final token = await integrity.getAttestationServiceSupport(
    challengeString: sessionId,
  );
}

3. 토큰을 서버로 전달해 검증

await api.verifyIntegrity(token);

📊 전체 플로우 (앱 ↔ 서버 ↔ Google)

sequenceDiagram
    participant APP
    participant API as API Server
    participant GOOGLE as Google Server

    APP->>API: nonce 발급 요청
    API-->>APP: nonce 발급 (고유 값 생성)
    APP->>GOOGLE: Play Integrity API 호출 (nonce 포함)
    GOOGLE-->>APP: signed token 반환 (JWT)
    APP->>API: token 전달 (검증 요청)
    
    note right of API: API 서버(백엔드)에서 로컬 검증 시작
    
    API->>API: 1. (캐시된) Google Public Key로 토큰 서명 검증
    API->>API: 2. 토큰 payload 디코딩
    API->>API: 3. nonce, timestamp, 앱 정보(패키지명) 등 확인
    
    note right of API: 검증 완료
    
    API-->>APP: OK (정품 앱/신뢰할 수 있음) 또는 Error