http升級https改造方案

 

一、解決方案

1、httpClient請求https版藍鯨接口

（1）、原理

https與http最大的區別在於SSL加密傳輸協議的使用。在自己寫的JAVA HttpClient程序，想手動驗證證書，可以在客戶端繞過驗證服務器證書的步驟，即則需要實現空的X509TrustManager接口。

類中的驗證方法返回void或者null，是為了繞過驗證。正常的方法體如果檢驗出證書無法被信任，需要手動拋出異常：

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building

failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

並在chtch中處理異常，如果想要繞過驗證，也就是說不要拋出異常就可以了，可以理解為信任了任何證書。

（2）、代碼展示：HttpsClientUtil.java

 

import org.apache.http.client.HttpClient;
import org.apache.http.client.config.AuthSchemes;
import org.apache.http.client.config.CookieSpecs;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.config.Registry;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.conn.socket.ConnectionSocketFactory;
import org.apache.http.conn.socket.PlainConnectionSocketFactory;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.*;
import org.apache.http.entity.StringEntity;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.message.BasicHeader;
import org.apache.http.util.EntityUtils;
/**
 * @author xiehaiqing
 * @date 2019/03/26
 */
public class HttpsClientUtil {
    /**
     * 在調用SSL之前需要重寫驗證方法，取消檢測SSL
     * 創建ConnectionManager，添加Connection配置信息
     * @return HttpClient 支持https
     */
    public static HttpClient sslClient(){
        try {
            // 在調用SSL之前需要重寫驗證方法，取消檢測SSL
            X509TrustManager trustManager = new X509TrustManager() {
                @Override
                public void checkClientTrusted(X509Certificate[] x509Certificates, String s)
                        throws CertificateException { }
                @Override
                public void checkServerTrusted(X509Certificate[] x509Certificates, String s)
                        throws CertificateException { }
                @Override
                public X509Certificate[] getAcceptedIssuers() {
                    return null;
                }
            };
            SSLContext ctx = SSLContext.getInstance(SSLConnectionSocketFactory.TLS);
            ctx.init(null, new TrustManager[]{trustManager}, null);
            SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(ctx, NoopHostnameVerifier.INSTANCE);
            //創建registry
            RequestConfig requestConfig = RequestConfig.custom().setCookieSpec(CookieSpecs.STANDARD_STRICT)
                    .setExpectContinueEnabled(Boolean.TRUE).setTargetPreferredAuthSchemes(Arrays.asList(AuthSchemes.NTLM, AuthSchemes.DIGEST))
                    .setProxyPreferredAuthSchemes(Arrays.asList(AuthSchemes.BASIC)).build();
            Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create().register("http", PlainConnectionSocketFactory.INSTANCE)
                    .register("https", socketFactory).build();
            // 創建ConnectionManager，添加Connection配置信息
            PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
            CloseableHttpClient closeableHttpClient = HttpClients.custom().setConnectionManager(connectionManager).setDefaultRequestConfig(requestConfig).build();
            return closeableHttpClient;
        }catch (KeyManagementException ex){
            throw new RuntimeException(ex);
        }catch (NoSuchAlgorithmException e){
            throw new RuntimeException(e);
        }
    }

    /**
     * post請求
     * @param url
     * @param jsonStr
     * @return
     */
    public static String doPost(String url,String jsonStr){
        HttpClient httpClient = null;
        HttpPost httpPost = null;
        String result = null;
        try{
            httpClient = sslClient();
            httpPost = new HttpPost(url);
            httpPost.addHeader("Content-type","applicattion/json");
            StringEntity se = new StringEntity(jsonStr);
            se.setContentType("text/json");
            se.setContentEncoding(new BasicHeader("Content-type","application/json"));
            httpPost.setEntity(se);
            HttpResponse response = httpClient.execute(httpPost);
            if (response !=null){
                HttpEntity entity = response.getEntity();
                if (entity !=null){
                    result = EntityUtils.toString(entity,"utf-8");
                }
            }
        }catch (Exception e){
            e.printStackTrace();
        }
        return result;
    }
}

 

 

 

 展開源碼 

2、模擬https版本登錄

（1）、原理

icube模擬登陸，即是通過服務的登錄鏈接，對用戶輸入的賬號密碼進行真實的驗證，本功能使用了Jsoup解析的方式實現。

具體邏輯為，先使用get請求鏈接的方式，生成登錄所需的bklogin_csrftoken這一屬性字段，然后在通過post攜帶用戶輸入的賬號密碼和該csrftoken字段進行登錄請求，如果用戶輸入的賬號密碼正確，則在cookie中會有一個不為空的bk_token字段，即為登錄成功，否則登錄失敗。對於https請求，需要在請求之前繞過證書驗證，這里采用創建不驗證證書鏈的信任管理器來實現。

登錄鏈接示例：https://xx.com/login/?c_url=

（2）代碼展示

 

import com.zork.opbd.datasource.Config;

import com.zork.opbd.log.SystemLogHelper;

import org.jsoup.Connection;

import org.jsoup.Connection.*;

import org.jsoup.Jsoup;

import org.jsoup.nodes.Document;

import org.jsoup.nodes.Element;

import org.jsoup.select.Elements;

 

import javax.net.ssl.*;

import java.security.KeyManagementException;

import java.security.NoSuchAlgorithmException;

import java.security.SecureRandom;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.util.*;



public class BKLoginUtils {

    public static String LOGIN_URL= Config.getInstance().BK_LOGIN_URL; //https://xx.com/login/?c_url=

    public final static String USER_AGENT="User-Agent";

    public final static String USER_AGENT_VALUE="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36";

    public final static String LOGINFORM = "#login-form";

    public final static String NAME = "name";

    public final static String VALUE = "value";

    public final static String USERNAME = "username";

    public final static String PASSWORD = "password";

    public final static String ID = "id";

    public final static String USER = "user";

    public final static String REFERER = "Referer";

    public final static String BKTOKEN = "bk_token";

 

 

    public static void main(String[] args) throws Exception {

        boolean admin = siMulateLogin("admin", "zork.8888");

        System.out.println(admin);

    }

 

    /**

     * 模擬登陸功能

     * @param userName

     * @param pwd

     * @return result

     */

    public static boolean siMulateLogin(String userName,String pwd){

        boolean result = false;

        try{

            checkQuietly();

            Connection con = Jsoup.connect(LOGIN_URL).timeout(30000).userAgent(USER_AGENT_VALUE);

            Response rs = con.execute();

            Document doc = Jsoup.parse(rs.body());

            List<Element> elements = doc.select(LOGINFORM);

            Elements allElements = elements.get(0).getAllElements();

            Iterator<Element> iterator = allElements.iterator();

            Map<String,String> datas = new HashMap<>();

            while (iterator.hasNext()){

                //賦值

                Element element = iterator.next();

                if (element.attr(NAME).equals(USERNAME) && element.attr(ID).equals(USER)){

                    element.attr(VALUE,userName);

                }

                if (element.attr(NAME).equals(PASSWORD) && element.attr(ID).equals(PASSWORD)){

                    element.attr(VALUE,pwd);

                }

                //排除空值表單屬性

                if (element.attr(NAME).length()>0){

                    datas.put(element.attr(NAME),element.attr(VALUE));

                }

            }

            Connection conn = Jsoup.connect(LOGIN_URL);

            conn.header(USER_AGENT,USER_AGENT_VALUE);

            conn.header(REFERER,LOGIN_URL);//注意，這一行必須要加，否則會驗證失敗

            Response login = conn.ignoreContentType(true).followRedirects(true).method(Method.POST).data(datas).cookies(rs.cookies()).execute();

            Map<String,String> cookies = login.cookies();

            Iterator<String> keyIter = cookies.keySet().iterator();

            while (keyIter.hasNext()){

                String key = keyIter.next();

                if (BKTOKEN.equals(key)){

                    if (!StringUtil.isNull(cookies.get(key))){

                        SystemLogHelper.info("獲取bk_token成功，bk_token:"+cookies.get(key),true);

                        result = true;

                    }else {

                        SystemLogHelper.info("獲取bk_token失敗，登陸失敗，請檢查用戶名或密碼",true);

                    }

                }

            }

        }catch (Exception e){

            e.printStackTrace();

        }

        return result;

    }

 

 

    /**

     * 信任管理器

     * 繞過證書驗證

     */

    public static void checkQuietly(){

        try{

            //創建不驗證證書鏈的信任管理器

            TrustManager[] trustAllCerts = {

                    new X509TrustManager() {

                        @Override

                        public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {

 

                        }

                        @Override

                        public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {

 

                        }

                        @Override

                        public X509Certificate[] getAcceptedIssuers() {

                            return null;

                        }

                    }

            };

            //安裝所有的信任管理器

            SSLContext ssl = SSLContext.getInstance("SSL");

            ssl.init(null,trustAllCerts,new SecureRandom());

            HttpsURLConnection.setDefaultSSLSocketFactory(ssl.getSocketFactory());

            //不驗證主機名

            HostnameVerifier hv = new HostnameVerifier() {

                @Override

                public boolean verify(String s, SSLSession sslSession) {

                    return true;

                }

            };

            HttpsURLConnection.setDefaultHostnameVerifier(hv);

        } catch (NoSuchAlgorithmException | KeyManagementException e) {

            e.printStackTrace();

        }

 

    }

}