Android和REST服务调用-代码审查

Question

I have asked a similar question but the answer did not help me. I am trying to call a rest service from my android app. The rest service looks like this:

@RestController
@RequestMapping("/login")
public class LoginController {
@ResponseBody
@RequestMapping(value = "/user", method = RequestMethod.GET)
public boolean getUser(@RequestParam(value = "name", required = true) String  userName, @RequestParam(value = "password", required = true) String password) {
        if (userName.equals("MMM") && password.equals("mmm")) {
            return true;
        } else {
            return false;
        }
    }
}

I start my REST service and I try to call it from my android app like this:

public void invokeWS(RequestParams params){

    AsyncHttpClient client = new AsyncHttpClient();
    client.setConnectTimeout(7000);
    client.get("https://ipaddress:8080/login/user/",params ,new AsyncHttpResponseHandler() {
        @Override
        public void onSuccess(int statusCode, Header[] headers, byte[] responseBody) {
            // Hide Progress Dialog
            prgDialog.hide();
            try {

                JSONObject obj = new JSONObject(responseBody.toString());

                if(obj.getBoolean("status")){
                    Toast.makeText(getApplicationContext(), "You are successfully logged in!", Toast.LENGTH_LONG).show();
                    // Navigate to Home screen
                    navigatetoHomeActivity();
                }
                // Else display error message
                else{
                    errorMsg.setText(obj.getString("error_msg"));
                    Toast.makeText(getApplicationContext(), obj.getString("error_msg"), Toast.LENGTH_LONG).show();
                }
            } catch (JSONException e) {
                // TODO Auto-generated catch block
                Toast.makeText(getApplicationContext(), "Error Occured [Server's JSON response might be invalid]!", Toast.LENGTH_LONG).show();
                e.printStackTrace();

            }
        }

        @Override
        public void onFailure(int statusCode, Header[] headers, byte[] responseBody, Throwable error) {

            prgDialog.hide();

            if(statusCode == 404){
                Toast.makeText(getApplicationContext(), "Requested resource not found", Toast.LENGTH_LONG).show();
            }
            else if(statusCode == 500){
                Toast.makeText(getApplicationContext(), "Something went wrong at server end", Toast.LENGTH_LONG).show();
            }
            // When Http response code other than 404, 500
            else{
                Toast.makeText(getApplicationContext(), statusCode + "Unexpected Error occcured! [Most common Error: Device might not be connected to Internet or remote server is not up and running]", Toast.LENGTH_LONG).show();
               // Toast.makeText(getApplicationContext(), "Unexpected Error occcured! [Most common Error: Device might not be connected to Internet or remote server is not up and running]", Toast.LENGTH_LONG).show();
            }
        }

    });
}

The status code that I receive is 0. When I use an API to test the REST service it is OK. I do not get any errors. I am on the same network and the firewall is turned off.

Answer 1

To understand what is going wrong you need to investigate in your "error" object in onFailure method

 @Override
    public void onFailure(int statusCode, Header[] headers, byte[] responseBody, Throwable error) {
        Log.i("ws", "---->>onFailure : " + error);
    }
    });

SUGGESTIONS:

1) Do not send password in GET!

The password must not be part of the url, please use POST and send the password in the request body

2) Your android code looks good, but it exist a native framework to call REST services called "VOLLEY" Volley offers the following benefits:

• Automatic scheduling of network requests.
• Multiple concurrent network connections.
• Transparent disk and memory response caching with standard HTTP cache coherence.
• Support for request prioritization.
• Cancellation request API. You can cancel a single request, or you can set blocks or scopes of requests to cancel.
• Ease of customization, for example, for retry and backoff.
• Strong ordering that makes it easy to correctly populate your UI with data fetched asynchronously from the network.
• Debugging and tracing tools.

the code is not more complex than yours...

EXAMPLE:

String url = "http://my-json-feed";

JsonObjectRequest jsonObjectRequest = new JsonObjectRequest
        (Request.Method.GET, url, null, new Response.Listener<JSONObject>() {

    @Override
    public void onResponse(JSONObject response) {
        mTextView.setText("Response: " + response.toString());
    }
}, new Response.ErrorListener() {

    @Override
    public void onErrorResponse(VolleyError error) {
        // TODO: Handle error

    }
});

https://developer.android.com/training/volley/

Answer 2

I can see you are doing a couple of "bad practices" here.

Problem 1

I can see your Spring Controller is wanting a Username and Password as URL parameters. This is a no. A server may log URL/endpoint requests which will now contain your credentials in plain text.

Fix option

1. Very common -> Use an Authorization header (most common: See Basic Auth) over HTTPS.
2. Less common -> Pass the username and password in a POST body.

Problem 2

Not using the framework as intended

I'd suggest using Spring Security. It will make your stuff a lot more secure and worth doing in the long run. It will take care of authentication, roles and password hashing all for you.