您的应用正在使用HostnameVerifier接口的不安全实现

时间:2017-03-11 07:16:23

标签: android security

我使用下面的代码并使用默认主机名验证程序。现在playstore不允许我更新应用程序。

public static HttpClient getHttpsClient() {
    HostnameVerifier hostnameVerifier = org.apache.http.conn.ssl.SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER;

    HttpClient mHttpClient = null;
    HttpParams httpParameters = new BasicHttpParams();

    HttpConnectionParams.setConnectionTimeout(httpParameters, HTTP_TIMEOUT);
    DefaultHttpClient client = new DefaultHttpClient(httpParameters);
    SchemeRegistry registry = new SchemeRegistry();
    SSLSocketFactory socketFactory = SSLSocketFactory.getSocketFactory();
    // X509HostnameVerifier hostnameVerifier = null;

    socketFactory
    .setHostnameVerifier((X509HostnameVerifier) hostnameVerifier);
    registry.register(new Scheme("http", new FakeSocketFactory(), 443));
    registry.register(new Scheme("https", PlainSocketFactory
            .getSocketFactory(), 80));

    SingleClientConnManager mgr = new SingleClientConnManager(client
            .getParams(), registry);
    mHttpClient = new DefaultHttpClient(mgr, client.getParams());
    final HttpParams params = mHttpClient.getParams();
    HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);

    HttpConnectionParams.setConnectionTimeout(params, HTTP_TIMEOUT);
    HttpConnectionParams.setSoTimeout(params, HTTP_TIMEOUT);
    HttpConnectionParams.setTcpNoDelay(httpParameters, true);
    ConnManagerParams.setTimeout(params, HTTP_TIMEOUT);
    return mHttpClient;

}

我得到了建议,我需要整合

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier()   {
        @Override
        public boolean verify(String hostname, SSLSession arg1) {
            if(hostname.equalsIgnoreCase("api.my.com") || hostname.equalsIgnoreCase("api.crashlytics.com") || hostname.equalsIgnoreCase("settings.crashlytics.com")){
                return true;
            }else {
                return false;
            }

        }
    });

我想知道如何将其集成到我的代码中?如果还有其他解决方案,请告诉我。

0 个答案:

没有答案