Prevent Screenshot and Screen Recording in Flutter (Android + iOS)

In this report, I will detail how to prevent screenshots and screen recording in a Flutter app for both Android and iOS platforms. During the development of a money-transfer feature for a fintech client, it was discovered that screenshots could be taken easily. The solution involves using the flutter_secure_screen package, which provides a native implementation for Android, and an alternative workaround for iOS.

This guide explains the steps to implement the solution on each platform and the nuances to consider when doing so.

To begin, add the flutter_secure_screen dependency to your Flutter project. The recommended approach is to use the package, which wraps the native code for you. Add the package to your `pubspec.yaml` file with the version `^3.0.0`, then run `flutter pub get` to fetch the package. For developers who prefer not to use a third-party package, the native implementation is outlined in the subsequent steps.

On Android, enabling the `FLAG_SECURE` flag is crucial for blocking screenshots, screen recording, and the recent-apps preview thumbnail. This can be achieved by importing the `flutter_secure_screen` package and initializing it with specific parameters. The `isEnable` flag should be set to `true` to enable protection, while `isEnableOCR` should be set to `false` to prevent optical character recognition from capturing sensitive information.

Additionally, `isEnableAccessibility` should be set to `true` to comply with accessibility requirements. For those who opt for the native solution, the `FLAG_SECURE` flag can be set directly in the `MainActivity.kt` file before the application's view renders.

On iOS, unlike Android, there is no direct flag to prevent screenshots. The workaround provided by the flutter_secure_screen package involves adding a hidden `UITextField` to the root view, which iOS treats as sensitive and blocks from being captured in screenshots. While this method effectively obscures sensitive information in screenshots, it is essential to understand that this is not a guaranteed solution and may be subject to change with iOS updates.

The package abstracts away the complexity of implementing this workaround on iOS, but users should be aware that it relies on undocumented behavior and may not be guaranteed by Apple.

To control the screenshot prevention per-screen, the guide suggests implementing a `ScreenProtector` class that toggles the protection feature based on the widget lifecycle. By calling `ScreenProtector.enable()` when a sensitive screen is mounted and `ScreenProtector.disable()` when it is unmounted, developers can ensure that the screenshot protection is only active on necessary screens, thereby optimizing performance and user experience.

For instance, an `OtpScreen` that handles one-time password entry could utilize this class to enable screenshot protection during input and disable it once the input process is complete.

Applying this pattern ensures that only the screens requiring protection benefit from the screenshot prevention measures, while others remain unaffected. This selective approach helps maintain the overall user experience of the app while safeguarding sensitive information on necessary screens. Developers should also consider backgrounding the app mid-flow and using `AppLifecycleListener` to re-enable the screenshot protection when the app resumes, ensuring that the security measures remain consistent regardless of user activity.

In summary, preventing screenshots and screen recording in a Flutter app involves adding a specific dependency, implementing platform-specific configurations, and controlling the protection based on the application's lifecycle. By following the outlined steps and understanding the nuances of each platform's capabilities and limitations, developers can effectively protect sensitive information in their Flutter applications.