Native vs Browser API Endpoints for Flutter Web

[AngryVelociraptor]

In this document, it says

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks, including CSRF login attacks.

My question is where it comes to Flutter, specifically Flutter web. Clearly, a Flutter app for a native platform needs to use the native endpoint, but will use of this endpoint on the web version open it up to CSRF attacks?

I'd appreciate help from someone with a better understanding of the technology and the threat model.

[vinckr]

Hello @AngryVelociraptor
Apologies for the late answer.

Not a Flutter user but I think since its always using a browser in the background you should use the browser endpoints with Flutter web.

Flutter web, when compiled, essentially becomes a single-page application running in the browser. From a security perspective, it behaves similarly to other browser-based JavaScript frameworks like React or Angular. Therefore, the same security considerations apply to Flutter web as to other web applications.