Android HttpClient 摘要认证授权 header "nc"硬编码

Question

我们尝试在一个 HttpClient(一个 session )中向目标服务器发送多个请求。目标服务器将首先使用摘要认证(基于 MD5-sess)对所有请求进行认证。结果显示只有第一次访问成功。以下访问被服务器拒绝，因为服务器将以后的访问视为重放攻击，因为“nc”值始终为“00000001”。

Android HttpClient 似乎硬编码摘要授权头属性“nc”为“00000001”？

客户端在发送新请求时有什么方法可以增加这个值？谢谢。

公共(public)类 HttpService {

private static final HttpService instance = new HttpService();
private HttpService() {
    client = getHttpClient();
}

public static HttpService getInstance() {
    return instance;
}

private DefaultHttpClient getHttpClient() {
    HttpParams params = new BasicHttpParams();
    HttpConnectionParams.setStaleCheckingEnabled(params, false);
    HttpConnectionParams.setConnectionTimeout(params, 15 * 1000);
    HttpConnectionParams.setSoTimeout(params, 15 * 1000);
    HttpConnectionParams.setSocketBufferSize(params, 8192);
    HttpProtocolParams.setUserAgent(params, USER_AGENT);

    SchemeRegistry schemeRegistry = new SchemeRegistry();
    Scheme httpScheme = new Scheme("http", PlainSocketFactory.getSocketFactory(), 80);
    Scheme httpsScheme = new Scheme("https", SSLCertificateSocketFactory.getHttpSocketFactory(30 * 1000, null), 443);
    schemeRegistry.register(httpScheme);
    schemeRegistry.register(httpsScheme);
    ClientConnectionManager manager = new ThreadSafeClientConnManager(params, schemeRegistry);

    //create client
    DefaultHttpClient httpClient = new DefaultHttpClient(manager, params);

    httpClient.getCredentialsProvider().setCredentials(new AuthScope(address, port),
                new UsernamePasswordCredentials(username, password));
}

Answer 1

Android 附带了一个极其过时的(预测试版)Apache HttpClient 分支。自 4.0 ALPHA 以来，HttpClient 的普通版本已经进行了无数次更改，在 Digest auth 区域也是如此。

您可以做的最好的事情是从 Apache HttpClient 的库存版本复制 DigestScheme，并将您的应用程序配置为使用副本而不是默认实现。

https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/DigestScheme.java

为此，您必须向身份验证方案注册表注册自定义 DigestSchemeFactory 实例。

https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/DigestSchemeFactory.java