secure http call in android

Question

How do I secure http call everytime I fire from my app and also it needs to have timeout so that any other user cannot use the same link from any browser.

I am looking for android solution in particular and not html form.

Please help me out. Unable to resolve this issue and dont know in which direction to proceed.

Thanks in Advance.

I am attaching the code for both PHP and Android which posts the Request and gets back the Response but no security is attached and any user can get the same Response by calling the same HTTP Response from Browser anytime...

Android code :

public class CustomizedListView extends Activity {
    // All static variables
    static final String URL = "http://example.com/getmsgs/strno=123";
    // XML node keys
    static final String KEY_SONG = "song"; // parent node
    static final String KEY_ID = "id";
    static final String KEY_TITLE = "title";
    static final String KEY_ARTIST = "artist";
    static final String KEY_DURATION = "duration";
    static final String KEY_THUMB_URL = "thumb_url";

    ListView list;
    LazyAdapter adapter;

    @Override
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.main);


        ArrayList<HashMap<String, String>> songsList = new ArrayList<HashMap<String, String>>();

        JSONObject json = JSONfunctions.getJSONfromURL(URL);


        try {
            JSONObject arr2 = json.getJSONObject("feed");
            JSONArray arr = arr2.getJSONArray("entry");

            for (int i = 0; i < arr.length(); i++) {
                JSONObject e1 = arr.getJSONObject(i);

                JSONArray arr3 = e1.getJSONArray("im:image");

                JSONObject arr8 = e1.getJSONObject("im:name");

                JSONObject arr10 = e1.getJSONObject("im:artist");

                    JSONObject e12 = arr3.getJSONObject(0);

            // creating new HashMap
            HashMap<String, String> map = new HashMap<String, String>();

            map.put(KEY_THUMB_URL,  e12.getString("label"));

            map.put(KEY_ARTIST, arr8.getString("label"));
            map.put(KEY_TITLE, arr10.getString("label"));
            // adding HashList to ArrayList
            songsList.add(map);
            }

        } catch (JSONException e) {
            // Log.e("log_tag", "Error parsing data "+e.toString());
            Toast.makeText(getBaseContext(),
                    "Network communication error!", 5).show();
        }


        list=(ListView)findViewById(R.id.list);

        // Getting adapter by passing xml data ArrayList
        adapter=new LazyAdapter(this, songsList);        
        list.setAdapter(adapter);

        // Click event for single list row
        list.setOnItemClickListener(new OnItemClickListener() {

            @SuppressWarnings("unchecked")
            @Override
            public void onItemClick(AdapterView<?> parent, View view,
                    int position, long id) {


                HashMap<String, String> o = (HashMap<String, String>) list.getItemAtPosition(position);
                Toast.makeText(CustomizedListView.this, "ID '" + o.get("KEY_TITLE") + "' was clicked.", Toast.LENGTH_SHORT).show(); 

            }
        });     
    }   
}

PHP code:

<?php

    $strno=$_GET['strno'];

    if (isset($strno))
    {
            $connect=mysql_connect("localhost","test","test") or die ('Connection error!!!');
            mysql_select_db("test") or die ('Database error!!!');

        $query=mysql_query("select sno FROM users  where strno='$strno';");
        while($row = mysql_fetch_assoc($query))

        {
            $jsonoutput='{"json":{
                "image":"'.$row['image'].'",
"artist":"'.$row['artist'].'",
"name":"'.$row['name'].'"
                }}';
        }

    }

    echo trim($jsonoutput);
    mysql_close($connect) or die ('Unable to close connection-error!!!');
    }

    ?>

Answer 1

Try to add some parameters like time to you request

http://example.com/getmsgs/strno=123&time=20130416130256&key=....

but

key = md5('20130416130256' + 'secret_string');

'secret_string' is secret of your app and server and first string is formatted gmt time ( Year Month Day Hour Minutes Seconds )

on the server side you can test time ( it must be like server time ) and test key ( it must be coorrect md5 )

onserever side it can be like this:

$strno = $_GET['strno'];
$stime = $_GET['time'];
$secret = 'secret_string';
$skey = $_GET['key'];

if( md5($stime . $secret) != $skey ) {
    die('Bad key');
}

$nCurTime = (int) gmdate('YmdHis');
if( ($stime > $nCurTime) || ($stime < ($nCurTime - 20) ) ) {
    die('Bad time');
}

// your code here ...

But I don't know how use function md5 and geting time

---

Add:

Some google search (android md5) give md5():

public static final String md5(final String s) {
try {
    // Create MD5 Hash
    MessageDigest digest = java.security.MessageDigest
            .getInstance("MD5");
    digest.update(s.getBytes());
    byte messageDigest[] = digest.digest();

    // Create Hex String
    StringBuffer hexString = new StringBuffer();
    for (int i = 0; i < messageDigest.length; i++) {
        String h = Integer.toHexString(0xFF & messageDigest[i]);
        while (h.length() < 2)
            h = "0" + h;
        hexString.append(h);
    }
    return hexString.toString();

} catch (NoSuchAlgorithmException e) {
    e.printStackTrace();
}
return "";
}

and getting gmt time Getting GMT time with Android