0

We've recently applied a certificate to the webservice that is used by our Android app.

I've changed the path to the webservice to the HTTPS one and all is working. No exception is thrown.

Below is the code I use to POST to the webservice:

HttpParams httpParameters = new BasicHttpParams();
// CONNECTION TIMEOUT
int timeoutConnection = 15000;
HttpConnectionParams.setConnectionTimeout(httpParameters, timeoutConnection);
// SOCKET TIMEOUT
int timeoutSocket = 30000;
HttpConnectionParams.setSoTimeout(httpParameters, timeoutSocket);
DefaultHttpClient httpClient = new DefaultHttpClient(httpParameters);
HttpPost httpPost = new HttpPost(getWebServiceAddress() + actionName);
httpPost.addHeader("Content-Type", "application/json; charset=utf-8");  
httpPost.addHeader("Accept-Encoding", "gzip");
httpPost.addHeader("User-Agent", "gzip");
httpPost.setEntity(new StringEntity(jsonBody, "UTF-8"));
HttpResponse response = null;
response = httpClient.execute(httpPost);

My question is: without changing Android code, is my outgoing communication from the app secure too? Do I have to apply any changes to the code pertaining to HTTPS to enforce the encryption?

bsempe
  • 68
  • 4

2 Answers2

0
  • is my outgoing communication from the app secure too?

If you use sockets use should use SSLSocket and put SslCertificate on it. With HttpURLConnection just change instance to HttpsURLConnection

-Do I have to apply any changes to the code pertaining to HTTPS to enforce the encryption?

If you want to send outgoing message then -yes,otherwise -no

Yahor10
  • 2,123
  • 1
  • 13
  • 13
  • I added the code to the question. Do you think any changes must be made? – bsempe Oct 31 '12 at 12:25
  • Add https register scheme for outgoing message.How to do it describe here: http://stackoverflow.com/questions/7714993/https-connection-with-client-certificate-in-an-android-app.Other code changes are necessary. – Yahor10 Oct 31 '12 at 12:33
0

Using WireShark on the server I was able to track down the packets being sent from my app to the server.

The packets were for an encrypted incoming connection through TLS protocol. Therefore my outgoing data IS secure and no other Android configuration is necessary.

bsempe
  • 68
  • 4