CODEWITHSUNDEEP
androidsslhttps
user3544092
user3544092

Reputation: 353

Creating secure connection to https

I'm sending GET and POST requests to a https server, i've googled some tutorials for working with https ssl and found various outdated tutorials

So now i'd like to know if my written code is secure or it's not secured at all

        final URL url = new URL(inputURL);
        final HttpsURLConnection conn_get = (HttpsURLConnection) url.openConnection();
        SSLSocketFactory sslSocketFactory = createTrustAllSslSocketFactory();
        conn_get.setSSLSocketFactory(sslSocketFactory);
        in = new BufferedInputStream(conn_get.getInputStream());
        ...

and the SSLSocketFactory

private static SSLSocketFactory createTrustAllSslSocketFactory() throws Exception {
    TrustManager[] byPassTrustManagers = new TrustManager[]{ new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }

        public void checkClientTrusted(X509Certificate[] chain, String authType) {
        }

        public void checkServerTrusted(X509Certificate[] chain, String authType) {
        }
    }};
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, byPassTrustManagers, new SecureRandom());
    return sslContext.getSocketFactory();
}

Should i change something or not for secure purposes?

Upvotes: 0

Views: 98

Answers (1)

CommonsWare
CommonsWare

Reputation: 1007554

So now i'd like to know if my written code is secure or it's not secured at all

It is not secure, as you are blindly accepting all SSL certificates, even fraudulent ones. Your app will not be allowed to ship on the Play Store, and in some countries you might be sued by the government.

Should i change something

Keep these lines:

final URL url = new URL(inputURL);
final HttpsURLConnection conn_get = (HttpsURLConnection) url.openConnection();
in = new BufferedInputStream(conn_get.getInputStream());

Delete everything else.

Upvotes: 2

Related Questions