假设有一个网站没有提供api服务。但是,合法的Android应用程序想要提供有用的服务。首先,他们要求用户在该网站上创建一个帐户。然后,一旦用户登录,他们就能够从应用程序中执行某些功能,例如“喜欢”帖子或评论内容。但很明显,CSRF令牌用于所有表单提交。 Android应用程序是否能够获取此令牌?如果没有,是否有办法要求用户获取权限
那么如何在android中执行此过程有任何一个答案?
这是我的代码我所做的,但我无法弄清楚当我们发出HttpPost
请求时它说没有正确使用csrf令牌/ Csrf令牌......
void sendGet() throws Exception {
String url = "http://manch.net.in/adda/accounts/login/";
String sessionId = "";
String key="";
URL obj = new URL(url);
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
String cs = CookieManager.getInstance().getCookie("http://manch.net.in/adda/accounts/login/");
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.execute(new HttpGet(url));
CookieStore cookieStore = httpclient.getCookieStore();
List <Cookie> cookies = cookieStore.getCookies();
System.out.println("cookieeeee"+cookies);
for (Cookie cookie: cookies) {
if (cookie.getName().equals("csrftoken")) {
CSRFTOKEN = cookie.getValue();
System.out.println("cccc"+CSRFTOKEN);
}
if (cookie.getName().equals("sessionid")) {
String session = cookie.getValue();
System.out.println("session"+session);
}
}
MunchWebViewClientDemoActivity d=new MunchWebViewClientDemoActivity();
int responseCode = con.getResponseCode();
System.out.println("\nSending 'GET' request to URL : " + url);
System.out.println("Response Code : " + responseCode);
BufferedReader in = new BufferedReader(
new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
response.append(inputLine);
}
in.close();
}
// HTTP POST request
void sendPost() throws Exception {
try {
HttpClient client = new DefaultHttpClient();
String postURL = "http://manch.net.in/adda/get_my_activity/";
HttpPost post = new HttpPost(postURL);
//post.addHeader("csrftoken", CSRFTOKEN);
List<NameValuePair> params = new ArrayList<NameValuePair>();
params.add(new BasicNameValuePair("username", "abhishekkeshri"));
params.add(new BasicNameValuePair("password", "1234"));
params.add(new BasicNameValuePair("csrftoken",CSRFTOKEN ));
UrlEncodedFormEntity ent = new UrlEncodedFormEntity(params,HTTP.UTF_8);
post.setEntity(ent);
HttpResponse responsePOST = client.execute(post);
HttpEntity resEntity = responsePOST.getEntity();
System.out.println("ressss"+resEntity.toString());
if (resEntity != null) {
Log.i("RESPONSE",EntityUtils.toString(resEntity));
}
} catch (Exception e) {
e.printStackTrace();
}
}
提前知道。