Building realtime apps with Flutter and WebSockets: client-side considerations

Globally, there is an ever-increasing appetite for data delivered in real time. Both producers and consumers are becoming more and more interested in faster experiences and instantaneous data transactions, with WebSockets being probably the most popular protocol for such use cases.

WebSockets represent a long-awaited evolution in the client/server web technology. They are a highly efficient and low-latency mechanism that enables bi-directional, full-duplex messages to be instantly distributed, with low overhead. Before WebSockets came along, the realtime web existed, but it was difficult to achieve, typically slower, and was implemented by hacking web technologies that were not designed for realtime applications. The WebSocket protocol is the one that gave way to a truly realtime web and elevated the possibilities of communication over the Internet.

Released only a few years ago but quickly gaining in popularity, Flutter is an open-source UI software development kit that can be used to develop natively compiled applications (primarily iOS and Android ones) from a single code base. Most of the Flutter system is implemented in Dart, a fast-growing modern object-oriented language optimized for client apps.

Flutter has in-built support for WebSockets via the web_socket_channel package, enabling you to connect to a WebSocket server, listen to messages emitted by the server, and send data to the server.

Since demand for realtime data is growing steadily, and with Flutter being a popular UI framework for building iOS and Android apps, I think it’s worth looking at some of the many challenges of implementing a dependable client-side Flutter solution that uses WebSockets.    
State of play — a brief overview

Rarely is a basic or raw WebSocket implementation enough for the needs of a realtime app that services an unknown (but potentially very high) number of users. Most of the time, you need to think about extending the capabilities of your Flutter client-side WebSocket implementation.

For this purpose, you could use an open-source solution like Websocket Manager, a Flutter plugin for building Android and iOS apps that use WebSockets. This is how you use Websocket Manager:

int messageNum = 0;
// Configure WebSocket url
final socket = WebsocketManager('wss://echo.websocket.org');
// Listen to close message
socket.onClose((dynamic message) {
    print('close');
});
// Listen to server messages
socket.onMessage((dynamic message) {
    print('recv: $message');
    if messageNum == 10 {
        socket.close();
    } else {
        messageNum += 1;
        final String msg = '$messageNum: ${DateTime.now()}';
        print('send: $msg');
        socket.send(msg);
    }
});
// Connect to server
socket.connect();

However, while it’s true that a solution like Websocket Manager offers some benefits (such as the ability to keep connections active in the background), it’s little more than a basic WebSocket client; it provides no rich additional functionality.

To get the most out of WebSockets, a protocol that’s built on top is often used, which enables richer functionality, such as pub/sub. You could choose to develop your own WebSocket-based protocol that is tailored specifically to your needs. However, that is a very complex and time-consuming undertaking. Most of the time, you are better off using an established WebSocket-based solution that is well prepared to handle an entire set of engineering complexities.

Here at Ably, we have a protocol for pub/sub that is used on top of WebSockets. It allows you to communicate over WebSockets by using a higher-level set of capabilities. To demonstrate how simple it is, here’s an example of how data is published to Ably channels:

// publish name and data
await channel.publish(name: "event1", data: "hello world");
await channel.publish(name: "event1", data: {"hello": "world", "hey": "ably"});
await channel.publish(name: "event1", data: [{"hello": {"world": true}, "ably": {"serious": "realtime"}]);

// publish single message
await channel.publish(message: ably.Message()..name = "event1"..data = {"hello": "world"});

// publish multiple messages
await channel.publish(messages: [
  ably.Message()..name="event1"..data = {"hello": "ably"},
  ably.Message()..name="event1"..data = {"hello": "world"}
]);

And here’s how clients subscribe to a channel to receive messages:

var messageStream = channel.subscribe();
var channelMessageSubscription = messageStream.listen((ably.Message message){
  print("New message arrived ${message.data}");
});

As you can see from the code snippets above, although the communication is done over WebSockets, the underlying WebSocket protocol is ‘’hidden’’ from developers.

You can decide to use any WebSocket-based protocol that supports Flutter. Regardless of your choice, though, you need to consider the entire spectrum of challenges you’ll face when it comes to WebSockets.
WebSockets and Flutter: what you need to consider

Before we get started, I must emphasize that this article only focuses on the client-side challenges of building a dependable WebSocket-based solution for realtime Flutter apps. I assume you have already decided what solution you want to use on the server-side. If you haven’t yet, you can go with an open-source library like Socket.IO, or a cloud-based solution like Ably.

It’s also worth mentioning that I’ve written this article based on the extensive collective knowledge that the Ably team possesses about the challenges of realtime communication via WebSockets.

I’m now going to dive into the key things you need to think about, such as authentication, network compatibility, or handling reconnections with continuity. Your client-side WebSocket implementation must be equipped to efficiently handle all these complexities if you are to build a reliable system.
Do you actually need WebSockets?

WebSocket is the most popular and portable realtime protocol. It provides full-duplex communication over a single TCP connection. WebSockets are a great choice for many use cases, such as financial tickers, chat solutions, or location-based apps, to name just a few. But it’s not the only available option. Before jumping on the WebSocket bandwagon, you should look at the existing alternatives, to make sure they are not a better fit for your use case.

For example, MQTT, which also supports bidirectional communication, is the go-to protocol for IoT devices with limited battery life, and for networks with expensive or low bandwidth, unpredictable stability, or high latency. Another example is Server-Sent Events, a lightweight protocol from both an implementation and usage standpoint. It’s a superior alternative for most browser-based scenarios where unidirectional communication is enough, such as users subscribing to a basic news feed.

WebSockets, MQTT, and SSE are all TCP-based protocols. TCP is designed to be a reliable transport layer protocol, which provides message delivery and ordering guarantees. This is great for many realtime use cases. But for other use cases, a lightweight, speedier protocol is a better option. For example, if your purpose is to stream video data, you’re better off using UDP as your transport layer protocol.

Even if WebSocket is a good choice for your needs, depending on the complexity of your architecture and what you are trying to achieve with your system, you might want to have the flexibility of using multiple protocols, one for each specific use case.

How We Solve It

Ably and protocol interoperability

https://pactforanimals.org/advert/march-madness-2021-live-kansas-vs-usc-live-stream-mens-basketball-free/

https://www.okbar.org/advert/watch-march-madness-2021-live-maryland-vs-alabama-live-stream-mens-basketball-free/

https://pactforanimals.org/advert/march-madness-2021-live-alabama-vs-maryland-live-stream-mens-basketball-free/

https://www.okbar.org/advert/ku-vs-usc-2021-live-kansas-vs-usc-live-stream-mens-basketball-free/

https://pactforanimals.org/advert/march-madness-2021-live-u-vs-usc-live-stream-mens-basketball-free/

https://pactforanimals.org/advert/march-madness-wyoming-vs-ucla-live-stream-womens-basketball-free/

https://www.okbar.org/advert/watch-free-ucla-vs-wyoming-2021-live-stream-womens-basketball-free/

https://pactforanimals.org/advert/watch-free-oregon-vs-south-dakota-live-stream-womens-basketball-free/

https://www.okbar.org/advert/march-madness-south-dakota-vs-oregon-live-stream-womens-basketball-free/

https://blog.goo.ne.jp/joliv/e/bfc686b7388826a0808ca83cd84719f9

https://www.deviantart.com/gdsffds/journal/Building-realtime-apps-with-Flutter-and-WebSocket-874025457

https://paiza.io/projects/AQsUyFVoIfyLdPUuC0f2Gg

https://caribbeanfever.com/photo/albums/flutter-and-websockets

At Ably, we embrace open standards and interoperability, and we believe that you should have the flexibility to choose the right protocol for the job at any given moment. That’s why we support WebSockets, SSE and MQTT, among other options.

Learn more about the protocols Ably supports
Authentication

Generally, it’s a good idea to only allow authenticated users to use a WebSocket connection. However, a raw WebSocket request has no header, so you’re unable to provide authentication in the way you might with an HTTP request. That’s why you need to use another component or service for authentication.

A client-side WebSocket library might be an option, but be careful when selecting one, as not all of them provide authentication mechanisms (or if they do, they can be quite limited). Alternatively, you can build your own authentication service. Most of the time, though, you are better off using a mature, feature-rich solution, such as a realtime messaging platform, that handles not only authentication, but an entire set of engineering complexities related to streaming data over WebSockets.

Let’s now look at the most common authentication mechanisms you can use over WebSockets. The first one, basic authentication, is the simplest option available (and also the least secure) and it involves the use of API keys. The credentials are usually passed as a query parameter in a URL, which looks something like this:

wss://realtime.ably.com/?key=MY_API_KEY&format=json&heartbeats=true&v=1.1&lib=js-web-1.2.1

From a security perspective, it’s recommended to only use basic authentication server-side, because exposing an API key to multiple clients is highly insecure. In theory, if you use ephemeral API key