[Q] Provide security while using http - Java for Android App Development

How to provide security when i use http for receiving the json response from the web server and also i'm sending the user details to the server to save those details in mysql db. I'm using HTTP post.

ThayarM said:
How to provide security when i use http for receiving the json response from the web server and also i'm sending the user details to the server to save those details in mysql db. I'm using HTTP post.
Click to expand...
Click to collapse
To provide security, I think you should use HTTPS post.

What user details? if the only user important data is the password, you only need to transform it in MD5 before to send it via HTTP.
The best and strong way to make a HTTP save connection is HTTPS, but if you want to make it easy, you can encrypt the json user data string, send via HTTP post, and decrypt it in the server. There are a lot of encrypt string examples in google.

Related

activesync 4.1 and exchange server 2003

I'm trying to synchronizise with the exchange server at my work.
But for some reason it doesn't work. I've filled in everything in the right way (address, domein etc.) the fault code is 80070002.
Can somebody help me with this?
same here at home (no firewalls)
Works fine for me. Exchange server needs just some configuration.
Priit said:
Works fine for me. Exchange server needs just some configuration.
Click to expand...
Click to collapse
What kind of configuration?
First, your Outlook Web Access (yes, OWA!) can not use forms based authentication nor SSL encryption. If you don want to use these (you most probably want to use SSL) then you need to create another virtual OWA directory without SSL and force ActiveSync (and Outlook Mobile Access) to use it.
More information at
http://support.microsoft.com/default.aspx?scid=kb;en-us;817379
Check if you can access OMA (Outlook Mobile Access) using http://yourserver/oma and check also Exchange server logs.
I thought this wasn't supported on WM5 until AKU 2.0 comes out (hopefully soon)
So ur saving I have to turn Forms authentication off and ssl off on OWA for my mobile device to work ?
sounds a bit of a poor show.
I need Forms based auth ideally as it goes through firewalls where as the other type does not.
Ours works here and we use SSL.
For the server name make sure you are using the fully qualified domain name that you use from the internet. IE: mail.domain.com. You don't have to put the /exchange on the end.
username, password and domain are all the same as what you use to log in.
OH, and the certificate you use on the server should be for mail.domain.com and not servername.
Hope this helps.
@spartanrob: DirectPush needs AKU2.0. You have always had possibility to sync manually. Or if your operator provides e-mail to SMS then you have the same functionality already today.
@Karzi:
No, I'm not saying you have to turn off SSL and/or forms-based auth., but you need to create another virtual OWA directory, which does not require SSL and forms-based authentication. You can limit access to this directory to localhost only so there will be no security concerns.
@MrHappy:
Your server is probably set up in that way.
Please go read this it helped me with the same error
http://hardware.mcse.ms/archive35-2005-11-248477.html
Basicly says that you have to download the cert from https://server.domain.com/certsrv then install the certificate on your desktop and your handheld then activesync will work....
I was hesitant but it worked for me.... it changed the path in the cert from my ip to my server.domain.com

Push mail user agent

My network provider currently has a very small whitelist for which User Agents can access the Internet through the GPRS (Web only) service. Opera on my Touch HD didn't make it to the list, but I managed to modify its user agent to HTC_TyTN_II and now I'm good to go.
However, push mail doesn't work too. Is there a method to modify the User-Agent which is sent in the HTTP headers of Pocket Outlook's push mail client? It is, after all, HTTP traffic.
Any ideas?

Signin via Google+ or Facebook?

Hello,
I am developing an App that requires the user to create an account and to sign in using that account. To make it easier for the user (certainly not for me), I want the user to create his or her account using an existing Google+ or Facebook account.
So my idea was:
Sign the user into Google+ on the device
Aquire the email address and and an oauth2 access-token for the user the
send those two to my server application
validate the email using the oauth2 token by reading it from the google server
create an account on the server, storing the email and generate a "password"
send the password back to the android app to authorize future calls to my server using the email and generated password
I am not sure if this is the recommended procedure for my problem, but anyway, I am failing at the third step.
Could someone please tell me if I am on the right way or should I solve the problem in some other way?
(mods: why does it say "this is not a Q&A forum but has Q&A in the title?)
onlyolli said:
Hello,
I am developing an App that requires the user to create an account and to sign in using that account. To make it easier for the user (certainly not for me), I want the user to create his or her account using an existing Google+ or Facebook account.
So my idea was:
Sign the user into Google+ on the device
Aquire the email address and and an oauth2 access-token for the user the
send those two to my server application
validate the email using the oauth2 token by reading it from the google server
create an account on the server, storing the email and generate a "password"
send the password back to the android app to authorize future calls to my server using the email and generated password
I am not sure if this is the recommended procedure for my problem, but anyway, I am failing at the third step.
Could someone please tell me if I am on the right way or should I solve the problem in some other way?
(mods: why does it say "this is not a Q&A forum but has Q&A in the title?)
Click to expand...
Click to collapse
I assume you follow Google's guide on G+ signin? I think that is a good way to do it, but I'm not so sure about that "password" you generate on your server. Wouldn't you just use the Android device id or something like that to validate the account?
SimplicityApks said:
I assume you follow Google's guide on G+ signin? I think that is a good way to do it, but I'm not so sure about that "password" you generate on your server. Wouldn't you just use the Android device id or something like that to validate the account?
Click to expand...
Click to collapse
Thank you!
I prefered using some server secret over the android device id, cause that one is not known to other applications.
Right now i guess i have the problem that the google api is not really picking up the certificate hash and as such is not using the correct project on the api console - that would explain why i am getting "api not configured" errors and why no api access is monitored on the developer console. Maybe. -.-

Own authorization server with rest.

Hi. How to write own authentication server with rest resources? At this moment we have server with Jersey and shiro. Users are stored in mysql database with hibernate.
Now I have problem how to join this with oauth to authenticate android users.
Also this auth/resources server will use vaadin webapp.
On other forum I get suggestion to use spring android framework. http://projects.spring.io/spring-android/
What option will be the best?

Expert opinion on HTTP header

Hi guys,
I'm working on an app at the moment but I can't get it to work.
I am trying to load a webpage by its IP address, usually this will not work because the server doesn't know what site you want to access in the case of a shared hosting etc. So I am injecting the "host domain.com" header into the request. However the page will still not load.
Anyone got an idea of how I can do this. I know I can use the host file but I'm trying to achieve it without admin privileges. on the pc.
Using wireshark the only difference I found in the packet were GET string in the HTTP header so not sure if I'm missing something..
There is no way to help you if you don't provide any sort of source code or dump of the packages you're sending.

Categories

Resources