Question

所以我最近在我的网站上实施了SSL证书，用于程序。 我在这里遇到的问题是程序发送到网站的POST数据是以纯文本形式发送的，这是一个非常大的问题，你可以想象。所有这一切，我已经看过其他堆栈溢出帖子，并实施了他们的解决方案，但他们似乎没有为我一点点工作。非常感谢任何帮助！

我如何调用帖子请求：

HttpClientFactory.sendPOSTRequest("https://www.somefakeurl.com/script", "version=7&username=SensitiveData&password=SensitiveData")

以下是我发送POST请求的方式：

public static String sendPOSTRequest(String URL, String data) throws Exception {
    String req = "sendPOSTRequest(" + URL.replace("https://www.somefakeurl.com", "") + ")";
    ByteArrayOutputStream baos = new ByteArrayOutputStream();

    SSLContext sslctx = SSLContext.getInstance("SSL");

    //See below for information on TmN...
    sslctx.init(null, new X509TrustManager[] { new TmN() }, null);

    HttpsURLConnection.setDefaultSSLSocketFactory(sslctx.getSocketFactory());
    URL url = new URL(URL);

    HttpsURLConnection con = (HttpsURLConnection) url.openConnection();
    con.setRequestProperty("User-Agent",
            "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.95 Safari/537.11");
    // con.setRequestProperty("Content-Type",
    // "application/x-www-form-urlencoded");
    con.setRequestMethod("POST");
    con.setDoOutput(true);

    // Basically just makes sure the data given is URLEncoded...
    if (data != null && !StringUtils.isWhitespace(data)) {
        String[] array0 = data.split("&");
        for (int i = 0; i < array0.length; i++) {
            String[] array1 = array0[i].split("=");
            try {
                array1[1] = URLEncoder.encode(array1[1], "UTF-8");
                array0[i] = String.join("=", array1);
            } catch (Exception e) {
                System.out.println("Error on: " + array0[i]);
                e.printStackTrace();
            }
        }
        data = String.join("&", array0);
    }

    OutputStream wr = con.getOutputStream();
    wr.write(data.getBytes());

    con.connect();
    if (con.getResponseCode() == HttpsURLConnection.HTTP_OK) {
        BufferedReader br = new BufferedReader(new InputStreamReader(con.getInputStream()));
        String line;
        while ((line = br.readLine()) != null) {
            baos.write(line.getBytes());
        }
        br.close();
    }
    con.disconnect();

    //Print and return the request
    String res = new String(baos.toByteArray());
    req += (" = " + res + "\n");
    System.out.println(req);
    return res;
}

这是我正在使用的信任经理。（我知道这个名字是非常规的，这是暂时的）：

   public class TmN extends X509ExtendedTrustManager{
    public void checkClientTrusted(X509Certificate[] chain, String authType) {
    }

    public void checkServerTrusted(X509Certificate[] chain, String authType) {
    }

    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }

    @Override
    public void checkClientTrusted(X509Certificate[] arg0, String arg1, Socket arg2) throws CertificateException {
        // TODO Auto-generated method stub

    }

    @Override
    public void checkClientTrusted(X509Certificate[] arg0, String arg1, SSLEngine arg2) throws CertificateException {
        // TODO Auto-generated method stub

    }

    @Override
    public void checkServerTrusted(X509Certificate[] arg0, String arg1, Socket arg2) throws CertificateException {
        // TODO Auto-generated method stub

    }

    @Override
    public void checkServerTrusted(X509Certificate[] arg0, String arg1, SSLEngine arg2) throws CertificateException {
        // TODO Auto-generated method stub

    }
}

最后但并非最不重要的是这是我的证明。这是使用Wireshark捕获的：

更新：所以我认为这个特定的帖子请求工作正常，wireshark再也找不到我之前搜索到的url结尾但是在同一个域但不同/页面结尾的不同请求仍未加密。它们都使用上述相同的功能，并以相同的方式格式化数据。我在这里错过了什么？

以明文形式发送的HTTPS POST请求？

0 个答案: