Month: November 2015

Java code to show case how java client deals with https certificates

Leave a Comment / Java / September 10, 2019

Visit a valid https site to see if there will be anything wrong public static void tryAuthorizedHttps() throws Exception { URL url = new URL(“https://www.baidu.com/”); HttpsURLConnection conn = (HttpsURLConnection) url.openConnection(); InputStream in = conn.getInputStream(); String page = IOUtils.toString(in, “utf8”); System.out.println(page); // successfully printed System.out.println(“===================”); //get the first X509 cert on the certificate chain X509Certificate x5Cert …

Java code to show case how java client deals with https certificates Read More »

Will there be security issues of self-made https certificates ?

Leave a Comment / Security / September 10, 2019

By self-made https certificates, I mean one of the two kinds: 1. A self-signed certificate 2. A certificate issued by an unknown CA, for example, the certificate of https://www.12306.cn is by the CA of China’s Railway Department. Will there be security issues?  Yes, there is a big issue, but you can work around it in some cases. …

Will there be security issues of self-made https certificates ? Read More »

What are the HTTPS Certificates in a C/S Communication and How are they verified?

Leave a Comment / Security / September 10, 2019

An Https Certificate (a.k.a X509 certificate) is used to show others that you are really who you says you are. In a https-based c/s communication, including b/s communication, in most of the cases only the server side has to show a certificate. The client doesn’t need one, otherwise it will be very inconvenient for clients. …

What are the HTTPS Certificates in a C/S Communication and How are they verified? Read More »

Prevent user attacking in HTTP RESTFul API calls

Leave a Comment / Security / November 1, 2015

This is an incomplete list of things you should consider when you want to prevent your users being attacked by others. Note this is about protecting individual consumers with username/password pairs, rather than application clients such as third-party companies, who normally carry AppKey/AppSecret pairs.  Authentication There are several options.   Sending username/password as http request …

Prevent user attacking in HTTP RESTFul API calls Read More »