Question

I am writing a basic android app for sending and receiving messages. I am also writing the server side code using Tomcat 7.0.21. I am currently trying to implement “programmatic web application security” (http://courses.coreservlets.com/Course-Materials/msajsp.html), where client authentication is performed explicitly.

I have now finished this implementation, and it works fine when I send a request using a REST client. However, when I send the request from an Android device/simulator, I get a java.io.FileNotFoundException. When I check the tomcat access logs, it seems tomcat is sending a 400 Bad Request before my Servlet code is even executed, thus producing the exception.

I don’t know whether this problem is client side or server side. Any insight or suggestions on how else to implement this would be greatly appeciated. Thank you.

Tomcat localhost_access_log:

192.168.1.2 - - [05/Dec/2012:12:20:39 +0100] "GET /CA/users/get_contacts?user_id=freespirit HTTP/1.1" 400 -

Servlet classes I extend, which I believe are never executed:

package carter.server.conversations;

import java.io.IOException;
import java.sql.Connection;
import java.sql.SQLException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import sun.misc.BASE64Decoder;
import carter.sqlite.SQLiteUtilities;
import carter.sqlite.conversations.DatabaseHelper;

public class AuthorizationServlet extends HttpsServlet {

    protected static final int SERVLET_EXCEPTION_UNAUTHORIZED = 1;

    @Override
    protected void doGet(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {

        super.doGet(request, response);

        String authorization = request.getHeader("Authorization");
        if(authorization == null){
            System.out.println("CAAuthorizationServlet: Authorization is null. Sending 401.");
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        }
        else{
            String base64encodedDetails = authorization.substring(6).trim(); //remove "BASIC " prefix
            BASE64Decoder decoder = new BASE64Decoder();
            String unencodedDetails = new String(decoder.decodeBuffer(base64encodedDetails));
            String[] userDetails = unencodedDetails.split(":");
            //check database for given details
            Connection databaseConnection = SQLiteUtilities.getConnection(Constants.databasePath);
            try{
                String password = DatabaseHelper.getPassword(userDetails[0], databaseConnection);
                if(password.equals(userDetails[1]) == false){
                    //password does not match this user
                    System.out.println("CAAuthorizationServlet: password does not match this user. Sending 401.");
                    response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                }
            }
            catch(SQLException e){
                // no such user found in database.
                System.out.println("CAAuthorizationServlet: no such user exists in database. Sending 401.");
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            }
            finally{
                SQLiteUtilities.closeConnection(databaseConnection);
            }
        }
    }

    @Override
    protected void doPost(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {

        super.doPost(request, response);
        doGet(request, response);
    }

}


package carter.server.conversations;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class HttpsServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        System.out.println("CAHttpsServlet: checking request is secure");
        if(request.isSecure() == false){
            System.out.println("CAHttpsServlet: Request is NOT secure. Sending 400");
            response.sendError(HttpServletResponse.SC_BAD_REQUEST);
        }
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        doGet(request, response);
    }

}

Answer 1

Um, you are rejecting the request in your own code:

protected void doGet(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {

    System.out.println("CAHttpsServlet: checking request is secure");
    if(request.isSecure() == false){
        System.out.println("CAHttpsServlet: Request is NOT secure. Sending 400");
        response.sendError(HttpServletResponse.SC_BAD_REQUEST);
    }
}