SNI support about mobile-android HOT 11 CLOSED

@jpkrohling so you have certificate for one domain but use it for another <photos.kroehling.de> != <app.cascaio.com>? Not sure why should it be fixed if it will cause security vulnerability.

from mobile-android.

@httpdispatch No, that would be wrong :-) I have an Apache server with one IP, serving several websites, all of them with SSL. For HTTP clients without support for SNI, the wrong certificate is sent to the client, which happens to be "app.cascaio.com" in this case. For clients with SNI, the client send the hostname on the first request, and the HTTP server sends the proper certificate (photos.kroehling.de , in this case). You can check that by opening https://photos.kroehling.de in a browser: for all current browsers, you'll see the proper certificate, for old browsers, you'd be served with a different one.

The latest version of Apache's HttpClient (4.3) have support for this, but the version from Android doesn't. The link I've sent with the blog post on Android's Developer blog has some more information on that, but basically, Android's UrlConnection (and HttpUrlConnection) also supports SNI.

from mobile-android.

@jpkrohling ok, i will investigate this more in such case. Once i will be able to fix it, i will need your help to test the build.

from mobile-android.

@httpdispatch Sure, no problem. I actually have played with the code yesterday, and I think I have a proposal patch, but I'm unable to build the APKs due to some other reasons. Is there a document somewhere with instructions on how to setup a developer environment?

from mobile-android.

On the main page you can find some information.
You need to fetch project source including submodule and create library projects for each used submodule

I've started to review problem and seems that there are no simple solution for it. There are 2 options: first you migrate to own port on your hosting, second we migrate all the api calls to HttpUrlConnection. Last option is a very complex update. I need to find some replacement for apache httpclient where i can use post requests, upload files, track upload progress and sign requests with OAuth credentials.

from mobile-android.

Indeed, there's no simple solution for this :-) What I've done in the past, when I really needed to use HttpClient from Apache was to repackage it under a different package name and ship it with the application. This increases the size of the APK, but it's a "solution". Of course, the proper one is to use HttpUrlConnection, but as you found out, this is a low level class and you'd need to perform pretty much everything manually.

As I mentioned, I have a proposed patch, mostly around the ApiBase.execute method, but I have to get my environment working before I submit it. Unfortunately, the information on the main README file is not very comprehensive. I'll try this night to get it working as per your instructions.

from mobile-android.

I hope to prepare eclipse environment setup instructions in few days so you can create your own build easily

from mobile-android.

@jpkrohling i've prepared instructions for building an app. You can find it here https://github.com/photo/mobile-android/wiki/Eclipse-build-environment-setup

from mobile-android.

Thanks a lot @httpdispatch for the wiki.

from mobile-android.

@jpkrohling could you test the app and see if your changes would solve the problem, please? Thanks a lot.

from mobile-android.

+1

from mobile-android.