sslError: SslError{message: Indicates the evaluation succeeded and the certificate is implicitly trusted, but user intent was not explicitly specified

Question

I am trying to use a web page which has microsoft AD login enabled to handle domain and non-domain login based on internal email(company users) or external(anyone using a valid email id), I also checked the pop ups and all are enabled for browsers.

I am getting below error for IOS devices ONLY, the same URL and login works fine on Device Browsers.

flutter: }, sslError: SslError{code: UNSPECIFIED, message: Indicates the evaluation succeeded and the certificate is implicitly trusted, but user intent was not explicitly specified.}}}

import 'package:flutter/material.dart';
import 'package:flutter/foundation.dart';
import 'package:url_launcher/url_launcher.dart';
import 'package:flutter_inappwebview/flutter_inappwebview.dart';

class CustomInAppBrowser extends StatefulWidget {
  final String url;

  const CustomInAppBrowser({super.key, required this.url});

  @override
  State<CustomInAppBrowser> createState() => _CustomInAppBrowserState();
}

class _CustomInAppBrowserState extends State<CustomInAppBrowser> {
  final GlobalKey webViewKey = GlobalKey();

  String url = '';
  String title = '';
  double progress = 0;
  bool? isSecure;
  InAppWebViewController? webViewController;

  @override
  void initState() {
    super.initState();
    url = widget.url;
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      body: Column(
        children: <Widget>[
          Expanded(
            child: Stack(
              children: [
                InAppWebView(
                  key: webViewKey,
                  initialUrlRequest: URLRequest(url: WebUri(widget.url)),
                  onNavigationResponse: (controller, navigationResponse) async {
                    debugPrint('navigationResponse: ${navigationResponse}');
                    return NavigationResponseAction.ALLOW;
                  },
                  onPermissionRequest: (controller, permissionRequest) async {
                    debugPrint('permissionRequest: ${permissionRequest}');
                    return PermissionResponse.fromMap({
                      'resources': permissionRequest.resources,
                      'action': PermissionResponseAction.GRANT
                    });
                  },
                  onReceivedServerTrustAuthRequest: (InAppWebViewController controller,
                      URLAuthenticationChallenge challenge) async {
                    debugPrint('onReceivedServerTrustAuthRequest: ${challenge}');
                    return ServerTrustAuthResponse(action: ServerTrustAuthResponseAction.PROCEED);
                  },
                  initialSettings: InAppWebViewSettings(
                    transparentBackground: true,
                    safeBrowsingEnabled: true,
                    isFraudulentWebsiteWarningEnabled: true,
                  ),
                  onWebViewCreated: (controller) async {
                    webViewController = controller;
                    if (!kIsWeb && defaultTargetPlatform == TargetPlatform.android) {
                      await controller.startSafeBrowsing();
                    }
                  },
                  onLoadStart: (controller, url) {
                    if (url != null) {
                      setState(() {
                        this.url = url.toString();
                        isSecure = urlIsSecure(url);
                      });
                    }
                  },
                  onLoadStop: (controller, url) async {
                    if (url != null) {
                      setState(() {
                        this.url = url.toString();
                      });
                    }

                    final sslCertificate = await controller.getCertificate();
                    setState(() {
                      isSecure = sslCertificate != null || (url != null && urlIsSecure(url));
                    });
                  },
                  onUpdateVisitedHistory: (controller, url, isReload) {
                    if (url != null) {
                      setState(() {
                        this.url = url.toString();
                      });
                    }
                  },
                  onTitleChanged: (controller, title) {
                    if (title != null) {
                      setState(() {
                        this.title = title;
                      });
                    }
                  },
                  onProgressChanged: (controller, progress) {
                    setState(() {
                      this.progress = progress / 100;
                    });
                  },
                ),
                progress < 1.0 ? LinearProgressIndicator(value: progress) : Container(),
              ],
            ),
          ),
        ],
      ),
    );
  }

  void handleClick(int item) async {
    switch (item) {
      case 0:
        await InAppBrowser.openWithSystemBrowser(url: WebUri(url));
        break;
      case 1:
        await webViewController?.clearCache();
        if (!kIsWeb && defaultTargetPlatform == TargetPlatform.android) {
          await webViewController?.clearHistory();
        }
        setState(() {});
        break;
    }
  }

  static bool urlIsSecure(Uri url) {
    return (url.scheme == "https") || isLocalizedContent(url);
  }

  static bool isLocalizedContent(Uri url) {
    return (url.scheme == "file" ||
        url.scheme == "chrome" ||
        url.scheme == "data" ||
        url.scheme == "javascript" ||
        url.scheme == "about");
  }
}

I have also specified the permission in Plist.info file

<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key><true/>
</dict>

Still I am getting the error as

I am trying to use webview and expected it to work same way it works directly in safari or chrome browser of iOS mobile devices!!

Answer 1

I implemented the following solution

 InAppWebView(
 shouldOverrideUrlLoading: (controller, action) async {
 return NavigationActionPolicy.ALLOW;
},
initialSettings: InAppWebViewSettings(
  mediaPlaybackRequiresUserGesture: false,
  useShouldOverrideUrlLoading: true,
  useHybridComposition: true,
 allowsInlineMediaPlayback: true,
),
),

This resolved the issue for me, ensuring that URL loading works smoothly without SSL errors disrupting the functionality. I referred to this GitHub comment for guidance.