CODEWITHSUNDEEP
androidhttpurlconnection
Arci
Arci

Reputation: 6819

Using HttpURLConnection and HttpsURLConnection to connect to an https?

What are the differences if I try to connect to an "https" using HttpURLConnection and HttpsURLConnection?

I was able to connect to "https" using both HttpURLConnection and HttpsURLConnection so I am confused. I thought I can only establish a connection to an "https" if I used HttpsURLConnection?

Below are some of my questions:

Upvotes: 28

Views: 16815

Answers (1)

Jeremy Edwards
Jeremy Edwards

Reputation: 14740

  1. HTTPS connection being used.
  2. Default Behaviors
  3. Not sure but read below.

I just wrote some code as a test (see all the way below). What ends up happening is the URL.openConnection() call will give you back a libcore.net.http.HttpsURLConnectionImpl class.

This is an implementation of HttpsURLConnection but HttpsURLConnection inherits from HttpURLConnection. So you're seeing polymorphism at work.

Looking further into the debugger it appears that the class is using the default factory methods.

hostnameVerifier = javax.net.ssl.DefaultHostnameVerifier

sslSocketFactory = org.apache.harmony.xnet.provider.jsse.OpenSSLSocketFactoryImpl

Based on this it looks like the default behaviors are being used. I don't know if that means if you're trusting everything but you are definitely establishing an HTTPS connection.

The documentation kinda hints at the connection will auto-trust CAs that are well known but not self-signed. (see below) I did not test this but they have example code on how to accomplish that here.

If an application wants to trust Certificate Authority (CA) certificates that are not part of the system, it should specify its own X509TrustManager via a SSLSocketFactory set on the HttpsURLConnection.

Runnable r = new Runnable() {

    public void run() {
        try {
        URL test = new URL("https://www.google.com/");
        HttpURLConnection connection = (HttpURLConnection) test.openConnection();
        InputStream is = connection.getInputStream();
        StringWriter sw = new StringWriter();
        String value = new java.util.Scanner(is).useDelimiter("\\A").next();
        Log.w("GOOGLE", value);
        } catch(Exception e) {
            Log.e("Test", e.getMessage());
        }
    }

};

Thread t = new Thread(r);
t.start();

Upvotes: 21

Related Questions