public static User fromJson(String json, final User old) { try { JSONObject object = new JSONObject(json); long id = object.getLong("id"); if (id == old.getId()) { Gson gson = new GsonBuilder().registerTypeAdapter(User.class, new InstanceCreator<User>() { @Override public User createInstance(Type type) { return old; } }).create(); return gson.fromJson(json, User.class); } } catch (JSONException e) { e.printStackTrace(); } return new Gson().fromJson(json, User.class); }
public static List<User> fromJson(String json, final List<User> old) { try { List<User> result = new ArrayList<>(); JSONArray array = new JSONArray(json); for (int i = 0; i < array.length(); i++) { JSONObject object = array.getJSONObject(i); final long id = object.getLong("id"); Gson gson = new GsonBuilder().registerTypeAdapter(User.class, new InstanceCreator<User>() { @Override public User createInstance(Type type) { return getUserById(old, id); } }).create(); result.add(gson.fromJson(object.toString(), User.class)); } return result; } catch (JSONException e) { e.printStackTrace(); } return new Gson().fromJson(json, new TypeToken<List<User>>() { }.getType()); }
private static User getUserById(List<User> users, long id) { for (User user : users) { if (user.getId() == id) { return user; } } return new User(); } }
HTTPS (also called HTTP over Transport Layer Security (TLS), HTTP over SSL, and HTTP Secure) is a communications protocol for secure communication over a computer network which is widely used on the Internet. HTTPS consists of communication over Hypertext Transfer Protocol (HTTP) within a connection encrypted by Transport Layer Security, or its predecessor, Secure Sockets Layer. The main motivation for HTTPS is authentication of the visited website and protection of the privacy and integrity of the exchanged data.
其实也很简单，我们把服务端的证书内置在我们的APP里，我们在做服务端证书校验的时候只比对是否和这个证书完全相同，不同就直接抛错，那中间人便没有办法绕过证书进行攻击。但是这里面也有一个问题就是服务端的证书可能会过期或者升级，而且服务端往往为了提高网络的安全性，证书的有效时间不会设置太长，这样APP就会因为这个证书的事情频繁发版，也很痛苦。（前段时间我司IOS的APP就是因为授权企业用户的证书没有及时更新，导致大家无法正常打开APP，血的教训导致我们不想重走这条路）可能你又想到了，我们可以把证书配置在后端，有更新的时候直接去下载不就完了，那我们的证书下载没有没拦截的风险吗，一旦拦截，我们所有的证书校验都会失效，比直接信任手机内置的证书更可怕。我们既不想只信任我们服务器的证书，又不想信任手机上所有的 CA 证书。有个不错的的信任方式是把签发我们服务器的证书的根证书导出打包到APP中，这样虽然不能做到百分之百的证书无漏洞，但是相比于信任手机中几百个证书，我们只信任一个风险会小很多，这也就是我们的QA妹子用Charles抓不了我们的包的原因。~~~
OkHttp attempts to balance two competing concerns:
Connectivity to as many hosts as possible. That includes advanced hosts that run the latest versions of boringssl and less out of date hosts running older versions of OpenSSL.
Security of the connection. This includes verification of the remote webserver with certificates and the privacy of data exchanged with strong ciphers.
