简体繁体 English

Android Webview 中的证书固定

[英]Certificate Pinning in Android Webview

原文 2016-10-06 05:28:59 3 1 android/ ssl/ webview/ ssl-certificate/ certificate-pinning

I am creating a small demo app to implement ssl certificate pinning in android webview.我正在创建一个小型演示应用程序来在 android webview 中实现 ssl 证书固定。 I have generated the certificates of the host.我已经生成了主机的证书。 Can anyone suggest me how to pin the certificates in the application code.谁能建议我如何在应用程序代码中固定证书。 I have searched many links but I am still stuck.我已经搜索了很多链接，但我仍然卡住了。

1 个解决方案

WebViews are tricky, not least because there is no perfect way to implement pinning in them except with Android N using Network Security Configuration . WebViews 很棘手，尤其是因为除了使用Network Security Configuration 的Android N 之外，没有完美的方法来实现固定。

The best you can do is override shouldInterceptRequest and implement the network calls yourself using one of the methods described in Android Security: SSL Pinning , however this only intercepts GET requests so if your WebViews use POST requests then you are out of luck.您能做的最好的事情是覆盖shouldInterceptRequest并使用Android Security: SSL Pinning 中描述的方法之一自己实现网络调用，但是这只会拦截 GET 请求，因此如果您的 WebViews 使用 POST 请求，那么您就不走运了。 Android-SSL-Pinning-WebViews shows an example of doing this. Android-SSL-Pinning-WebViews显示了执行此操作的示例。