managing-secure-storage

SecureStorage Encrypted Storage Guide (v10.x)

Goal

Implement encrypted key-value storage for sensitive data using flutter_secure_storage. Leverages platform-native secure storage (iOS Keychain, Android Keystore) for maximum security.

Process

Phase 1: Install Dependencies

dependencies:
  flutter_secure_storage: ^10.0.0

Phase 2: Platform Configuration

Android (android/app/build.gradle):

android {
    compileSdkVersion 34  // Minimum 18
    
    defaultConfig {
        minSdkVersion 18
    }
}

Android Backup Exclusion (AndroidManifest.xml):

<application
  android:fullBackupContent="@xml/backup_rules"
  android:allowBackup="true">

Android Backup Rules (res/xml/backup_rules.xml):

<?xml version="1.0" encoding="utf-8"?>
<full-backup-content>
  <!-- Exclude secure storage from Google Drive backups -->
  <exclude domain="sharedpref" path="FlutterSecureStorage"/>
</full-backup-content>

iOS: No additional configuration required (uses Keychain by default).

Phase 3: Create Secure Storage Wrapper

import 'package:flutter_secure_storage/flutter_secure_storage.dart';

class SecureStorage {
  static const _storage = FlutterSecureStorage(
    aOptions: AndroidOptions(
      encryptedSharedPreferences: true,
      resetOnError: true, // Auto-reset on biometric change invalidation
    ),
    iOptions: IOSOptions(
      accessibility: KeychainAccessibility.first_unlock,
      accountName: AppleOptions.defaultAccountName,
    ),
  );
  
  // Access Token
  static Future<String?> getAccessToken() => _storage.read(key: _Keys.accessToken);
  static Future<void> setAccessToken(String value) => _storage.write(key: _Keys.accessToken, value: value);
  static Future<void> deleteAccessToken() => _storage.delete(key: _Keys.accessToken);
  
  // Refresh Token
  static Future<String?> getRefreshToken() => _storage.read(key: _Keys.refreshToken);
  static Future<void> setRefreshToken(String value) => _storage.write(key: _Keys.refreshToken, value: value);
  
  // API Key
  static Future<String?> getApiKey() => _storage.read(key: _Keys.apiKey);
  static Future<void> setApiKey(String value) => _storage.write(key: _Keys.apiKey, value: value);
  
  // User Credentials (for biometric unlock)
  static Future<String?> getStoredPassword() => _storage.read(key: _Keys.password);
  static Future<void> setStoredPassword(String value) => _storage.write(key: _Keys.password, value: value);
  
  // Clear all secure data (logout)
  static Future<void> clearAll() => _storage.deleteAll();
  
  // Check if key exists
  static Future<bool> hasAccessToken() async {
    final token = await getAccessToken();
    return token != null && token.isNotEmpty;
  }
}

class _Keys {
  static const String accessToken = 'access_token';
  static const String refreshToken = 'refresh_token';
  static const String apiKey = 'api_key';
  static const String password = 'stored_password';
}