Ensuring the HTTPS connection was properly set up

Question

According to the Android Documentation:

Assuming you have a web server with a certificate issued by a well known CA, you can make a secure request with code as simple this:

URL url = new URL("https://wikipedia.org");
URLConnection urlConnection = url.openConnection();
InputStream in = urlConnection.getInputStream();
copyInputStreamToOutputStream(in, System.out);

Yes, it really can be that simple.

I am currently working on an Android project and now want to start introducing a User System (DataBase of users/passwords, registration/log in capabilities, etc.).

Here is how we are currently handling the connection (in the Android section of the project):

package com.example.payne.simpletestapp;


import org.osmdroid.util.BoundingBox;

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;


public class ServerConnection {

    public String serverAddress;
    public int port;

    public ServerConnection(String addr, int port){
        this.serverAddress = addr;
        this.port = port;

    }

    public ServerConnection(String addr){

        this.port = 80;
        this.serverAddress = addr;

    }

    /**
     * Envoie une requête au serveur de façon périodique.
     * <p></p>
     * Reçoit toutes les alertes sur le territoire
     *
     * @return
     */
    public String ping(BoundingBox boundingBox) throws Exception {

        String param =
            "?nord=" + boundingBox.getLatNorth() +
            "&sud=" + boundingBox.getLatSouth() +
            "&est=" + boundingBox.getLonEast() +
            "&ouest=" + boundingBox.getLonWest();

        return this.getRequest("/alertes", param);

    }


    public String getRequest(final String path, final String param) throws Exception {

        final Response result = new Response();

        Thread connection = new Thread(new Runnable() {

            @Override
            public void run() {

                try{
                    URL obj = new URL(serverAddress + path + param);
                    HttpURLConnection con = (HttpURLConnection) obj.openConnection();

                    // optional default is GET
                    con.setRequestMethod("GET");
                    // int responseCode = con.getResponseCode();

                    BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));
                    String inputLine;
                    StringBuffer response = new StringBuffer();

                    while ((inputLine = in.readLine()) != null) {
                        response.append(inputLine);
                    }

                    in.close();

                    result.response = response.toString();

                } catch (Exception e){
                    e.printStackTrace();
                }
            }
        });

        connection.start();
        connection.join();


        return result.response;

    }

    public Boolean postAlert(Alerte alerte) {

        boolean success = false;
        alerte.log();

        String param =  "?type=" + alerte.type +
                        "&lat=" + alerte.getLatitude() +
                        "&lng=" + alerte.getLongitude();

        try {
            this.getRequest("/putAlert", param);
            success = true;
        } catch (Exception e) {
            e.printStackTrace();
        }

        return success;

    }


}

Note that elsewhere, another member of the team seems to have been establishing connections differently (in the 'backend' section of the project, which is used by the server, and not necessarily by Android):

private String getRssFeed() {
    try {
        String rss = "";
        URL rssSource = new URL("https://anURLwithHTTPS.com/");
        URLConnection rssSrc = rssSource.openConnection();
        BufferedReader in = new BufferedReader(
                new InputStreamReader(
                        rssSrc.getInputStream(), StandardCharsets.UTF_8));
        String inputLine;

        while ((inputLine = in.readLine()) != null) {
            rss += inputLine;
        }

        in.close();

        String rssCleaned = rss.replaceAll("&lt;", "<").replaceAll("&gt;", ">").substring(564);

        return rssCleaned;
    } catch (MalformedURLException ex) {
        Logger.getLogger(AlertesFluxRss.class.getName()).log(Level.SEVERE, null, ex);
    } catch (IOException ex) {
        Logger.getLogger(AlertesFluxRss.class.getName()).log(Level.SEVERE, null, ex);
    }
    return "";
}

The questions are:

1. Will the first code presented (the Android-related one) use an encrypted connection (HTTPS)?
2. What about the second one?
3. How do we test if the information that was sent is encrypted?
4. Is casting to HttpURLConnection a threat? The documentation seems to indicate that it would automatically recast into "HttpsURLConnection".
5. Since HttpsURLConnection extends HttpURLConnection, it has all of the capacities HttpURLConnection and more, right?

I did find this, but it wasn't exactly what I was looking for.

Our current idea for registering new users would be to send their information within an URL through en encrypted connection (along the lines of https://myWebsite.com/api/?user=Bob&pass=amazing) to the server (hosted on https://www.heroku.com).

If there are better ways to do such a thing, please let me know. Suggestions will be gladly considered. I'm not too knowledgeable when it comes to Libraries neither, so please share anything you know that might make my approach more secure and fast to implement.

Thank you so much for your help in advance! :)

Answer 1

Will the first code presented (the Android-related one) use an encrypted connection (HTTPS)?

Not without seeing the URL the 'first code presented' uses, which isn't shown. In the Android sample you quoted, the URL string "https://wikipedia.org" guarantees it, by definition. If it starts with https:, it uses HTTPS, which is encrypted: otherwise, it doesn't, and isn't.

What about the second one?

Yes, for the reason given above.

How do we test if the information that was sent is encrypted?

You don't. You use an https: URL. The rest is automatic. It works. Worked for 22 years. No testing required. Don't test the platform. If you must check it, attempt a typecast to HttpsURLConnection. If it's HTTPS, that will succeed: otherwise, fail.

Is casting to HttpURLConnection a threat?

No. I don't understand why you ask.

The documentation seems to indicate that it would automatically recast into "HttpsURLConnection".

No it doesn't. It indicates than an HttpsURLConnection is created. No casting.

Since HttpsURLConnection extends HttpURLConnection, it has all of the capacities HttpURLConnection and more, right?

Right.