Question

我正在编写一个用于发送和接收消息的基本Android应用程序。我也在使用Tomcat 7.0.21编写服务器端代码。我目前正在尝试实现＆＃34;程序化Web应用程序安全性＆＃34; （http://courses.coreservlets.com/Course-Materials/msajsp.html），其中明确执行客户端身份验证。

我现在已经完成了这个实现，当我使用REST客户端发送请求时，它工作正常。但是，当我从Android设备/模拟器发送请求时，我得到一个java.io.FileNotFoundException。当我检查tomcat访问日志时，似乎tomcat在我的Servlet代码执行之前发送了400 Bad Request，从而产生异常。

我不知道这个问题是客户端还是服务器端。关于如何实现这一点的任何见解或建议都将受到极大的限制。谢谢。

Tomcat localhost_access_log：

192.168.1.2 - - [05/Dec/2012:12:20:39 +0100] "GET /CA/users/get_contacts?user_id=freespirit HTTP/1.1" 400 -

我扩展的Servlet类，我相信它永远不会被执行：

package carter.server.conversations;

import java.io.IOException;
import java.sql.Connection;
import java.sql.SQLException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import sun.misc.BASE64Decoder;
import carter.sqlite.SQLiteUtilities;
import carter.sqlite.conversations.DatabaseHelper;

public class AuthorizationServlet extends HttpsServlet {

    protected static final int SERVLET_EXCEPTION_UNAUTHORIZED = 1;

    @Override
    protected void doGet(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {

        super.doGet(request, response);

        String authorization = request.getHeader("Authorization");
        if(authorization == null){
            System.out.println("CAAuthorizationServlet: Authorization is null. Sending 401.");
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        }
        else{
            String base64encodedDetails = authorization.substring(6).trim(); //remove "BASIC " prefix
            BASE64Decoder decoder = new BASE64Decoder();
            String unencodedDetails = new String(decoder.decodeBuffer(base64encodedDetails));
            String[] userDetails = unencodedDetails.split(":");
            //check database for given details
            Connection databaseConnection = SQLiteUtilities.getConnection(Constants.databasePath);
            try{
                String password = DatabaseHelper.getPassword(userDetails[0], databaseConnection);
                if(password.equals(userDetails[1]) == false){
                    //password does not match this user
                    System.out.println("CAAuthorizationServlet: password does not match this user. Sending 401.");
                    response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                }
            }
            catch(SQLException e){
                // no such user found in database.
                System.out.println("CAAuthorizationServlet: no such user exists in database. Sending 401.");
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            }
            finally{
                SQLiteUtilities.closeConnection(databaseConnection);
            }
        }
    }

    @Override
    protected void doPost(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {

        super.doPost(request, response);
        doGet(request, response);
    }

}


package carter.server.conversations;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class HttpsServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        System.out.println("CAHttpsServlet: checking request is secure");
        if(request.isSecure() == false){
            System.out.println("CAHttpsServlet: Request is NOT secure. Sending 400");
            response.sendError(HttpServletResponse.SC_BAD_REQUEST);
        }
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        doGet(request, response);
    }

}

Answer 1

嗯，你在自己的代码中拒绝了这个请求：

protected void doGet(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {

    System.out.println("CAHttpsServlet: checking request is secure");
    if(request.isSecure() == false){
        System.out.println("CAHttpsServlet: Request is NOT secure. Sending 400");
        response.sendError(HttpServletResponse.SC_BAD_REQUEST);
    }
}

Answer 2

它似乎与Same Origin Policy相关。

您需要在Tomcat服务器上启用跨域请求。

为此，您需要在Tomcat的ROOT webapp上创建一个crossdomain.xml文件，其内容如下：

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <site-control permitted-cross-domain-policies="all"/>
    <allow-access-from domain="*" />
    <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

在使用身份验证标头处理android请求之前，Tomcat会发送400秒

2 个答案: