java - Why does volley encrypt my post-request without telling it so -
i trying login remote address uses https. use volley send post-request user data.
this relevant code (includes setting stringrequest -> fire stringrequest
):
stringrequest mystringrequest = new stringrequest(request.method.post, remoteurl, this, this) { @override public map<string, string> getheaders() throws authfailureerror { map<string, string> headers = new hashmap<>(); headers.put("accept-charset","utf-8"); headers.put("connection","keep-alive"); headers.put("user-agent","mozilla/5.0 (x11; ubuntu; linux x86_64; rv:40.0) gecko/20100101 firefox/40.0"); headers.put("content-type","application/x-www-form-urlencoded"); return headers; } @override protected map<string, string> getparams() throws authfailureerror { map<string, string> params = new hashmap<>(); params.put("name","myname"); params.put("pw","mypw"); params.put("totp",""); params.put("app","76"); return params; } }; singletonvolley.getinstance().getrequestqueue(getactivity().getapplicationcontext()).add(mystringrequest);
where singleton instantiating newrequestqueue
looks following:
public class singletonvolley { private static singletonvolley minstance = new singletonvolley(); private requestqueue mrequestqueue; private singletonvolley() { } public static singletonvolley getinstance() { return minstance; } public synchronized requestqueue getrequestqueue(context context) { if(mrequestqueue == null) { mrequestqueue = volley.newrequestqueue(context); } return mrequestqueue; }
}
however when running code can see wireshark
data sent encrypted using tlsv1.2
:
no. time source destination protocol length info 11 2.898033000 192.168.0.19 80.190.158.9 tcp 74 57186 > https [syn] seq=0 win=29200 len=0 mss=1460 sack_perm=1 tsval=11207479 tsecr=0 ws=128 12 2.929011000 80.190.158.9 192.168.0.19 tcp 74 https > 57186 [syn, ack] seq=0 ack=1 win=14480 len=0 mss=1460 sack_perm=1 tsval=210621220 tsecr=11207479 ws=128 13 2.929044000 192.168.0.19 80.190.158.9 tcp 66 57186 > https [ack] seq=1 ack=1 win=29312 len=0 tsval=11207487 tsecr=210621220 14 2.930506000 192.168.0.19 80.190.158.9 tlsv1.2 284 client hello 15 2.959979000 80.190.158.9 192.168.0.19 tcp 66 https > 57186 [ack] seq=1 ack=219 win=15616 len=0 tsval=210621228 tsecr=11207487 16 2.964700000 80.190.158.9 192.168.0.19 tlsv1.2 1514 server hello 17 2.964742000 192.168.0.19 80.190.158.9 tcp 66 57186 > https [ack] seq=219 ack=1449 win=32128 len=0 tsval=11207496 tsecr=210621229 18 2.967946000 80.190.158.9 192.168.0.19 tlsv1.2 1725 certificate 19 2.967997000 192.168.0.19 80.190.158.9 tcp 66 57186 > https [ack] seq=219 ack=3108 win=35456 len=0 tsval=11207496 tsecr=210621229 20 2.993710000 192.168.0.19 80.190.158.9 tlsv1.2 192 client key exchange, change cipher spec, encrypted handshake message 21 3.027476000 80.190.158.9 192.168.0.19 tlsv1.2 324 new session ticket, change cipher spec, encrypted handshake message 22 3.030701000 192.168.0.19 80.190.158.9 tlsv1.2 471 application data 23 3.107383000 80.190.158.9 192.168.0.19 tcp 66 https > 57186 [ack] seq=3366 ack=750 win=16640 len=0 tsval=210621265 tsecr=11207512 35 3.194115000 80.190.158.9 192.168.0.19 tcp 1514 [tcp segment of reassembled pdu] 36 3.195622000 80.190.158.9 192.168.0.19 tlsv1.2 6488 application data 37 3.195653000 192.168.0.19 80.190.158.9 tcp 66 57186 > https [ack] seq=750 ack=11236 win=54144 len=0 tsval=11207553 tsecr=210621286 535 63.283062000 80.190.158.9 192.168.0.19 tlsv1.2 97 encrypted alert 536 63.283534000 80.190.158.9 192.168.0.19 tcp 66 https > 57186 [fin, ack] seq=11267 ack=750 win=16640 len=0 tsval=210636286 tsecr=11207553 537 63.320615000 192.168.0.19 80.190.158.9 tcp 66 57186 > https [ack] seq=750 ack=11268 win=54144 len=0 tsval=11222585 tsecr=210636286
regarding many other questions on so
can see have pass sslsocketfactory
when creating newrequestqueue
. while sounds absolutely logically me, wonder why program default did not add sslsocketfactory
. wonder if have newer version of volley other user used when asking question on in past. when looking @ source-code of volley not able find detection when using https-url
automatically assigns sslsocketfactory
requestqueue
. hope can bring light in issue.
addition
only sslsocketfactory
relevant stuff find in hurlstack.class
:
constructor:
public hurlstack(urlrewriter urlrewriter, sslsocketfactory sslsocketfactory) { murlrewriter = urlrewriter; msslsocketfactory = sslsocketfactory; }
evaluation if sslsocketfactory passed:
// use caller-provided custom sslsocketfactory, if any, https if ("https".equals(url.getprotocol()) && msslsocketfactory != null) { ((httpsurlconnection)connection).setsslsocketfactory(msslsocketfactory); }
so "https".equals(url.getprotocol())
evaluate true in case msslsocketfactory != null
not!
it doesn't have got socket factory. have specified https
, got https
.
Comments
Post a Comment