验证Android应用程序的后端呼叫

时间:2013-01-23 12:21:09

标签: java android maven google-api-java-client google-oauth

我正在关注next tutorial以保证我的休息服务。

但我对步骤验证令牌字段有疑问,首先我不知道我的依赖关系是否正确:

    <dependency>
        <groupId>com.google.api-client</groupId>
        <artifactId>google-api-client</artifactId>
        <version>1.13.1-beta</version>
    </dependency>
    <dependency>
        <groupId>com.google.http-client</groupId>
        <artifactId>google-http-client-gson</artifactId>
        <version>1.13.1-beta</version>
    </dependency>

其次,当我在示例中使用类Checker时,在调用Verifier.verify(token)中它返回 false ,这是因为在类GoogleIdTokenVerifier中Set clientIds 为空。我一步一步地按照教程,我完全失去了

谢谢大家。


编辑:这是我现在使用的代码,它似乎正在运行:

public class Checker {

private final String mAudience;
private final Lock lock = new ReentrantLock();
private final GoogleIdTokenVerifier mVerifier;
private final JsonFactory mJFactory;
private String mProblem = "Verification failed. (Time-out?)";
private final List<String> mClientIDs;
private List<PublicKey> publicKeys;
private final Clock clock;
NetHttpTransport transport;
private long expirationTimeMilliseconds;

public Checker(String[] clientIDs, String audience) {
    mClientIDs = Arrays.asList(clientIDs);
    mAudience = audience;
    transport = new NetHttpTransport();
    mJFactory = new GsonFactory();
    mVerifier = new GoogleIdTokenVerifier(transport, mJFactory);
    clock = Clock.SYSTEM;
}

public GoogleIdToken.Payload check(String tokenString) {
    GoogleIdToken.Payload payload = null;

    try {
        GoogleIdToken token = GoogleIdToken.parse(mJFactory, tokenString);
        if (checkSignature(mClientIDs.get(0), token)) {
            GoogleIdToken.Payload tempPayload = token.getPayload();
            if (!tempPayload.getAudience().equals(mAudience))
                mProblem = "Audience mismatch";
            else if (!mClientIDs.contains(tempPayload.getIssuee()))
                mProblem = "Client ID mismatch";
            else
                payload = tempPayload;
        }
    } catch (GeneralSecurityException e) {
        mProblem = "Security issue: " + e.getLocalizedMessage();
    } catch (IOException e) {
        mProblem = "Network problem: " + e.getLocalizedMessage();
    } catch (Exception e) {
        mProblem = "Problem: " + e.getLocalizedMessage();
    }
    return payload;
}

public String problem() {
    return mProblem;
}

boolean checkSignature(String clientIds, GoogleIdToken idToken)
        throws GeneralSecurityException, IOException {
    JsonWebSignature.Header header = idToken.getHeader();
    String algorithm = header.getAlgorithm();
    if (algorithm.equals("RS256")) {
        lock.lock();
        try {
            if (publicKeys == null
                    || clock.currentTimeMillis() + 300000 > expirationTimeMilliseconds) {
                mVerifier.loadPublicCerts();
                publicKeys = mVerifier.getPublicKeys();
                expirationTimeMilliseconds = mVerifier
                        .getExpirationTimeMilliseconds();
            }
            Signature signer = Signature.getInstance("SHA256withRSA");
            for (PublicKey publicKey : publicKeys) {
                signer.initVerify(publicKey);
                signer.update(idToken.getSignedContentBytes());
                if (signer.verify(idToken.getSignatureBytes())) {
                    return true;
                }
            }
        } finally {
            lock.unlock();
        }
    }
    return false;
}
}

1 个答案:

答案 0 :(得分:0)

不了解您的依赖关系;那是Maven对吗?我是一个Maven白痴。

至于你的clientID,代码假设你要传递一个clientID列表,因为你想确定你知道你要与哪个客户交谈。如果你不想这样做,我可以看到两个明显的选择:

  • 只需删除构造函数的clientIds参数,mClientIDs成员变量,以及check()方法中的“if(!mClientIDs.contains()”调用。

  • 更改代码以跳过检查mClientIDs是否为空