从Android应用程序现场登录。 无法发送POST请求。 使用GET请求发送密码可以吗？ 我应该加密吗？

Question

I'm trying to login on my site from my Android app. Sending a POST request is apparently not possible, so the only way is sending a GET request. Is it fine to send password this way? Should I encrypt it somehow?

Answer 1

the way to do this, you should encode your details by using base64_encode function and pass it through "GET" params.

Additionally, you may add something to mixed up the password. So this will depends on how you want to display and pass your log in credentials.

*Note: for mobile, I think it can't use encrypt function like bcrypt in PHP.

Hope this helps!

Answer 2

I do not think it is possible for you to send your device user's credentials through HTTP GET. If you could go through GET though with some weird method of coding it wont be secure unless it is encryped and SSL is recommended. However it is very possible through HTTP POST and it can be encrypted as well. You should be using SSL for the POST. Here is some sample code if you need a reference.

    case R.id.login_login_but:
        Toast.makeText(this, "Logging in...", Toast.LENGTH_SHORT).show();

        ArrayList<NameValuePair> postLogin = new ArrayList<NameValuePair>();
        postLogin.add(new BasicNameValuePair("post_user", "User"));
        postLogin.add(new BasicNameValuePair("post_pass", "Pass));

        try {
            String response = null;
            response = CustomHttpClient.executeHttpPost(
                    "http://giveaway.synamegames.com/appfiles/login.php", postLogin);
            String res = response.toString();
            res = res.replaceAll("\\s+", "");

            if (res.equals(1)) {
            // logged in
            } else {
            // incorrect user or password
            }

        } catch (Exception e) {
            Toast.makeText(this, "Server timeout please try again later. You must have internet.", Toast.LENGTH_SHORT).show();
        }
    break;

And the PHP script I used was...

<?php
$username=$_POST['post_user'];
$password=$_POST['post_pass'];
$user = 'db_user';
$pswd = 'db_password';
$db = 'db_name';
$server = 'www.domain.com';
$conn = mysql_connect($server, $user, $pswd);
mysql_select_db($db, $conn);
$query=mysql_query("SELECT * FROM users  WHERE  pass =('$password') AND user = $username")or die(mysql_error());

if(mysql_num_rows($query)==1) {
echo 1;
} else {
echo 0;
}
mysql_close($conn);
?>

Answer 3

You may have to do both encrypting and sending a POST request. If your signing in process is available as an API, you can use WebRESTClient to do the same..

Also, You can do simple hashing like

MessageDigest md5Hash = MessageDigest.getInstance("MD5");
mDigest = md5Hash.digest(password.getBytes());
String hashedMessage = new String(Hex.encodeHex(mDigest));