2

I used to make my connection to php for mysql with HTTP, Now I am asked to use HTTPS as it is more secure. but i tried too many ways but can't get the tablet to POST or GET any information, I made a self signed certificate and added to Local Computer trusted zone so i wont be asked that its is not verified do i want to continue, i tried connecting by browser and it worked fine and printed all the info that i needed, but not through the application. i attached my previous HTTP code that i need to change to HTTPS. would like some help to change this connection to HTTPS.

    httpclient = new DefaultHttpClient();
    httppost = new HttpPost ("http://xx.xx.xx.xx/E-MENU/login.php");        
    username = etUser.getText().toString();
    password = etPass.getText().toString();
    password = md5(SHA1(password));

try{
    nameValuePairs = new ArrayList<NameValuePair>();
    nameValuePairs.add(new BasicNameValuePair("username", username));
    nameValuePairs.add(new BasicNameValuePair("password", password));
    httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));
    response = httpclient.execute(httppost);


if(response.getStatusLine().getStatusCode() == 200){
    entity = response.getEntity();
        if (entity!= null){

InputStream instream = entity.getContent();
JSONObject jsonResponse = new JSONObject (convertStreamToString(instream));

1 Answer 1

0
Log.e("body", body);
            HttpClient httpclient = getNewHttpClient();

            HttpPost httppost = new HttpPost("https://www.demo.com/login.php");

             nameValuePairs = new ArrayList<NameValuePair>();
nameValuePairs.add(new BasicNameValuePair("username", username));
nameValuePairs.add(new BasicNameValuePair("password", password));
httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));


            httppost.setEntity(entity);
            response = httpclient.execute(httppost);;


            Log.e("response", response.getStatusLine().toString());
            String aaa = response.getStatusLine().toString();
            Toast.makeText(getApplicationContext(), "Content :"+ aaa, Toast.LENGTH_LONG).show();
            HttpEntity entity1 = response.getEntity();
            is = entity1.getContent();

                //Toast.makeText(getApplicationContext(), "Content :"+ (CharSequence) is, Toast.LENGTH_LONG).show();

        }catch(Exception e){
            Log.e("log_tag", "Error in http connection "+e.toString());
        }


public HttpClient getNewHttpClient() {
        try {
            KeyStore trustStore = KeyStore.getInstance(KeyStore
                    .getDefaultType());
            trustStore.load(null, null);

            SSLSocketFactory sf = new MySSLSocketFactory(trustStore);
            sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

            HttpParams params = new BasicHttpParams();
            HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1);
            HttpProtocolParams.setContentCharset(params, HTTP.UTF_8);

            SchemeRegistry registry = new SchemeRegistry();
            registry.register(new Scheme("http", PlainSocketFactory
                    .getSocketFactory(), 80));
            registry.register(new Scheme("https", sf, 443));

            ClientConnectionManager ccm = new ThreadSafeClientConnManager(
                    params, registry);

            return new DefaultHttpClient(ccm, params);
        } catch (Exception e) {
            return new DefaultHttpClient();
        }
    }

MySSLSocketFactory.java

public class MySSLSocketFactory extends SSLSocketFactory {
    SSLContext sslContext = SSLContext.getInstance("TLS");

    public MySSLSocketFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
        super(truststore);

        TrustManager tm = new X509TrustManager() {
            public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            }

            public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            }

            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };

        sslContext.init(null, new TrustManager[] { tm }, null);
    }

    @Override
    public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException, UnknownHostException {
        return sslContext.getSocketFactory().createSocket(socket, host, port, autoClose);
    }

    @Override
    public Socket createSocket() throws IOException {
        return sslContext.getSocketFactory().createSocket();
    }
}

Add this if you working above 4.0 , in your code

 StrictMode.ThreadPolicy policy = new StrictMode.ThreadPolicy.Builder().permitAll().build();
         StrictMode.setThreadPolicy(policy);
Sign up to request clarification or add additional context in comments.

4 Comments

This sample uses a "null trust manager" which is very bad from a security perspective and therefore should be only used in test environments. Additionally this is in this case unnecessary as the certificate has already been added as trusted certificated.
@Robert : Whats is alternative ? can you please say
Read section "Using your own trust store: HttpClient" of nelenkov.blogspot.de/2011/12/…
regarding "$ ./importcert.sh cacert.pem" openssl is not accepting it saying $ is not openssl command

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.