即使輸入了錯誤的密碼並且文件未保存在服務器上，我也總是得到服務器響應正常200

Question

我正在使用Android APP中的Java類將文件上傳到服務器。 我正在使用一個簡單的PHP Skript來檢查密碼。 如果輸入了錯誤的密碼，該文件將不會保存在服務器上，應該會得到403，但從服務器上會得到200。

這是Java類

class httpUploadFile {
    private int serverResponseCode = 0;
     int uploadFile(String upLoadServerUri, String uploadFilePath, String uploadFileName,String pfad) {
            String sourceFileUri=uploadFilePath + "" + uploadFileName;
         HttpURLConnection conn;
            DataOutputStream dos;
            String lineEnd = "\r\n";
            String twoHyphens = "--";
            String boundary = "*****";
            int bytesRead, bytesAvailable, bufferSize;
            byte[] buffer;
            int maxBufferSize = 1024 * 1024;
            File sourceFile = new File(sourceFileUri);
         if (!sourceFile.isFile()) {
             Log.e("uploadFile", "Source File not exist :"
                     +uploadFilePath + "" + uploadFileName);
             return 0;
         }
            try {
                FileInputStream fileInputStream = new FileInputStream(sourceFile);
                String fulluri=getUrl(upLoadServerUri,pfad);
                URL url = new URL(fulluri);
                conn = (HttpURLConnection) url.openConnection();
                conn.setDoInput(true); // Allow Inputs
                conn.setDoOutput(true); // Allow Outputs
                conn.setUseCaches(false); // Don't use a Cached Copy
                conn.setRequestMethod("POST");
                conn.setRequestProperty("Connection", "Keep-Alive");
                conn.setRequestProperty("ENCTYPE", "multipart/form-data");
                conn.setRequestProperty("Content-Type", "multipart/form-data;boundary=" + boundary);
                conn.setRequestProperty("uploaded_file", sourceFileUri);
                dos = new DataOutputStream(conn.getOutputStream());
                dos.writeBytes(twoHyphens + boundary + lineEnd);
                dos.writeBytes("Content-Disposition: form-data; name=\"uploaded_file\";filename=\""
                                + sourceFileUri + "\"" + lineEnd);
                        dos.writeBytes(lineEnd);
                // create a buffer of  maximum size
                bytesAvailable = fileInputStream.available();
                bufferSize = Math.min(bytesAvailable, maxBufferSize);
                buffer = new byte[bufferSize];
                // read file and write it into form...
                bytesRead = fileInputStream.read(buffer, 0, bufferSize);
                while (bytesRead > 0) {
                    dos.write(buffer, 0, bufferSize);
                    bytesAvailable = fileInputStream.available();
                    bufferSize = Math.min(bytesAvailable, maxBufferSize);
                    bytesRead = fileInputStream.read(buffer, 0, bufferSize);
                }
                // send multipart form data necesssary after file data...
                dos.writeBytes(lineEnd);
                dos.writeBytes(twoHyphens + boundary + twoHyphens + lineEnd);
                // Responses from the server (code and message)
                serverResponseCode = conn.getResponseCode();
                String serverResponseMessage = conn.getResponseMessage();
                Log.i("uploadFile", "HTTP Response is : "
                        + serverResponseMessage + ": " + serverResponseCode);
                fileInputStream.close();
                dos.flush();
                dos.close();
            } catch (MalformedURLException ex) {

                ex.printStackTrace();

                  Log.e("Upload file to server", "error: " + ex.getMessage(), ex);
            } catch (Exception e) {

                e.printStackTrace();

                Log.e("Upload file Exception", "Exception : "
                        + e.getMessage(), e);
            }

            return serverResponseCode;
        }
    private String getUrl(String BASE_URL,String pfad) {
        String token = getToken();
        String key = getKey(token);
        return String.format("%s?token=%s&key=%s&pfad=%s&", BASE_URL, token, key,pfad);
    }

    private String getKey(String token) {
        return md5(String.format("%s+%s", "wrongpassword", token));
    }

    private String getToken() {
        return md5(UUID.randomUUID().toString());
    }

    private static String md5(String s) {
        MessageDigest m = null;
        try {
            m = MessageDigest.getInstance("MD5");
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }
        assert m != null;
        m.update(s.getBytes(), 0, s.length());
        return new BigInteger(1, m.digest()).toString(16);
    }
    }

這是PHP

<?php
$shared_secret = "password";    
$key = $_GET['key'];    
$token = $_GET['token'];    
$pfad = $_GET['pfad'];    
if ($key != hash("md5", "{$shared_secret}+{$token}")) {    
  header('HTTP/1.0 403 Forbidden');    
  die('403 Forbidden: You are not allowed to access this file.');
}    
$file_path = "/home/www/data/".$pfad."/";
$file_path = $file_path . basename( $_FILES['uploaded_file']['name']);
if(move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $file_path)) {
    echo "success";
} else {
    echo "fail";
}
?>

Answer 1

HTTP 200表示在HTTP級別上傳輸正常，也就是說，請求在技術上正常 ，服務器能夠正確響應。

200不會判斷您的業務邏輯是對還是錯，因此即使密碼錯誤，也只有在服務器和客戶端之間的http通信正常時，才會返回200 。

通常，如果服務器上發生技術或不可恢復的問題，我們將使用HTTP 5xx進行響應。 如果傳入請求有問題（例如錯誤的參數），則為HTTP 4xx

您的后端服務器應做以上判斷。