koobas.hobune.stream
Android HTTPS POST Request
I am having a heck of a time wrapping my head around the TLS handshake concept
Unity Docs use this:
using UnityEngine.Networking;
using System.Security.Cryptography.X509Certificates;
// Based on https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#.Net
class RequestCertificate: CertificateHandler
{
// Encoded RSAPublicKey
private static string PUB_KEY = "30818902818100C4A06B7B52F8D17DC1CCB47362" +
"C64AB799AAE19E245A7559E9CEEC7D8AA4DF07CB0B21FDFD763C63A313A668FE9D764E" +
"D913C51A676788DB62AF624F422C2F112C1316922AA5D37823CD9F43D1FC54513D14B2" +
"9E36991F08A042C42EAAEEE5FE8E2CB10167174A359CEBF6FACC2C9CA933AD403137EE" +
"2C3F4CBED9460129C72B0203010001";
protected override bool ValidateCertificate(byte[] certificateData)
{
X509Certificate2 certificate = new X509Certificate2(certificateData);
string pk = certificate.GetPublicKeyString();
if (pk.Equals(PUB_KEY))
return true;
// Bad dog
return false;
}
}
I am using a node / express server with a Letsencrypt certificate.
I tried UnityWebRequest first.
protected IEnumerator Register()
{
List<IMultipartFormSection> wwwForm = new List<IMultipartFormSection>();
wwwForm.Add(new MultipartFormDataSection("name", uName.text));
wwwForm.Add(new MultipartFormDataSection("email", uEmail.text));
wwwForm.Add(new MultipartFormDataSection("screenName", uScreenName.text));
wwwForm.Add(new MultipartFormDataSection("password", uConPass.text));
UnityWebRequest www = UnityWebRequest.Post(US_GameManager.API_URL + "users/store-user", wwwForm);
www.certificateHandler = new RequestCertificate();
Debug.Log(www.certificateHandler);
yield return www.SendWebRequest();
if (www.isNetworkError || www.isHttpError)
{
debugText.text += " Error: " + www.error;
}
else
{
}
}
I get
Mono.Security.Interface.TlsException: Handshake failed - error code: UNITYTLS_INTERNAL_ERROR, verify result: UNITYTLS_X509VERIFY_NOT_DONE
Then I tried
public void SendRegisterRequest(string endPoint, RegistrationRequestBody playerData)
{
var http = (HttpWebRequest)WebRequest.Create(US_GameManager.API_URL + endPoint);
http.ContentType = "application/json";
http.Method = "POST";
string l_result = string.Empty;
using (var streamWriter = new StreamWriter(http.GetRequestStream()))
{
string reqBody = JsonConvert.SerializeObject(playerData);
streamWriter.Write(reqBody);
streamWriter.Flush();
streamWriter.Close();
var response = (HttpWebResponse)http.GetResponse();
using (var streamReader = new StreamReader(response.GetResponseStream()))
{
l_result = streamReader.ReadToEnd();
debugText.text += $"SendRegisterRequest() {l_result} \n";
}
}
m_regRes = (RegistrationResponseBody)DSRegistraionResponse(l_result);
debugText.text += $" m_regRes: {m_regRes} route: {US_GameManager.API_URL }{m_endPoint} \n";
Debug.Log("Reg Res: " + m_regRes.Message);
// response body status == 200
if (m_regRes.Status == 200)
{
sceneManager.SetUserId(m_regRes.userId);
print("RES userId: " + m_regRes.userId);
debugText.text += $" m_regRes: {m_regRes} route: {m_endPoint} \n";
Player.name = m_regRes.name;
Player.userId = m_regRes.userId;
Player.screenName = m_regRes.screenName;
Player.scores = m_regRes.scores;
Player.lastScenePlayed = m_regRes.lastScenePlayed;
Player.friendsList = m_regRes.friendsList;
Player.isLoggedIn = true;
PlayerPrefs.SetString("userID", m_regRes.userId);
//sceneManager.LoadScene(2); // Registration successful => load lobby
}
}
And to make matters worse this code makes it to the same API
public async void CheckEmailExists(string email)
{
//Debug.Log("SceneManager.GetUserById() UserId exists");
try
{
HttpResponseMessage response = await client.GetAsync(US_GameManager.API_URL + checkEmailRoute + email);
response.EnsureSuccessStatusCode();
string responseBody = await response.Content.ReadAsStringAsync();
print($"Found Email: {responseBody}");
if (responseBody == "200")
{
emailExistsError.gameObject.SetActive(true);
}
}
catch (HttpRequestException e)// 404 rout not found because there is no UserId stored on device
{
Debug.Log(e);
}
}
With the same result. One thing that throws me is when is RequestCertificate.ValidateCertificate() being called? Any and all help is greatly appreciated.
