驗證Android應用的後端呼叫

Question

我正在關注next tutorial以對我的Rest服務進行驗證。

但是我有步驟有問題驗證代碼字段，首先我不知道，如果我的依賴關係是正確的：

<dependency> 
     <groupId>com.google.api-client</groupId> 
     <artifactId>google-api-client</artifactId> 
     <version>1.13.1-beta</version> 
    </dependency> 
    <dependency> 
     <groupId>com.google.http-client</groupId> 
     <artifactId>google-http-client-gson</artifactId> 
     <version>1.13.1-beta</version> 
    </dependency> 

其次，當我使用該類檢查像例如，在電話Verifier.verify(token)中它返回虛假，這是因爲在類GoogleIdTokenVerifier集clientIds是空。我按照教程一步一步，我完全失去了

謝謝大家。

---

編輯：這是我現在使用的代碼，它似乎是工作：

public class Checker { 

private final String mAudience; 
private final Lock lock = new ReentrantLock(); 
private final GoogleIdTokenVerifier mVerifier; 
private final JsonFactory mJFactory; 
private String mProblem = "Verification failed. (Time-out?)"; 
private final List<String> mClientIDs; 
private List<PublicKey> publicKeys; 
private final Clock clock; 
NetHttpTransport transport; 
private long expirationTimeMilliseconds; 

public Checker(String[] clientIDs, String audience) { 
    mClientIDs = Arrays.asList(clientIDs); 
    mAudience = audience; 
    transport = new NetHttpTransport(); 
    mJFactory = new GsonFactory(); 
    mVerifier = new GoogleIdTokenVerifier(transport, mJFactory); 
    clock = Clock.SYSTEM; 
} 

public GoogleIdToken.Payload check(String tokenString) { 
    GoogleIdToken.Payload payload = null; 

    try { 
     GoogleIdToken token = GoogleIdToken.parse(mJFactory, tokenString); 
     if (checkSignature(mClientIDs.get(0), token)) { 
      GoogleIdToken.Payload tempPayload = token.getPayload(); 
      if (!tempPayload.getAudience().equals(mAudience)) 
       mProblem = "Audience mismatch"; 
      else if (!mClientIDs.contains(tempPayload.getIssuee())) 
       mProblem = "Client ID mismatch"; 
      else 
       payload = tempPayload; 
     } 
    } catch (GeneralSecurityException e) { 
     mProblem = "Security issue: " + e.getLocalizedMessage(); 
    } catch (IOException e) { 
     mProblem = "Network problem: " + e.getLocalizedMessage(); 
    } catch (Exception e) { 
     mProblem = "Problem: " + e.getLocalizedMessage(); 
    } 
    return payload; 
} 

public String problem() { 
    return mProblem; 
} 

boolean checkSignature(String clientIds, GoogleIdToken idToken) 
     throws GeneralSecurityException, IOException { 
    JsonWebSignature.Header header = idToken.getHeader(); 
    String algorithm = header.getAlgorithm(); 
    if (algorithm.equals("RS256")) { 
     lock.lock(); 
     try { 
      if (publicKeys == null 
        || clock.currentTimeMillis() + 300000 > expirationTimeMilliseconds) { 
       mVerifier.loadPublicCerts(); 
       publicKeys = mVerifier.getPublicKeys(); 
       expirationTimeMilliseconds = mVerifier 
         .getExpirationTimeMilliseconds(); 
      } 
      Signature signer = Signature.getInstance("SHA256withRSA"); 
      for (PublicKey publicKey : publicKeys) { 
       signer.initVerify(publicKey); 
       signer.update(idToken.getSignedContentBytes()); 
       if (signer.verify(idToken.getSignatureBytes())) { 
        return true; 
       } 
      } 
     } finally { 
      lock.unlock(); 
     } 
    } 
    return false; 
} 
} 

Answer 1

不知道你的依賴;這是Maven的權利？我是Maven白癡。

至於你的clientIDs，代碼假設你將傳遞一個clientID列表，因爲你想確保你知道你要和哪個客戶端通話。如果你不想這樣做，我可以看到兩個明顯的選擇：

• 只是刪除的clientId參數構造函數中，mClientIDs成員變量，以及「IF（mClientIDs.contains（）！」調用檢查（）方法。

• 更改代碼跳過檢查是否mClientIDs是空