Twilio REST-API允许主机名验证程序问题

Question

我正试图使用Twilio REST API创建一个组室，但我面临崩溃：

Process: com.example.twilioroom, PID: 25401
java.lang.NoSuchFieldError: No static field INSTANCE of type Lorg/apache/http/conn/ssl/AllowAllHostnameVerifier; in class Lorg/apache/http/conn/ssl/AllowAllHostnameVerifier; or its superclasses (declaration of 'org.apache.http.conn.ssl.AllowAllHostnameVerifier' appears in /system/framework/framework.jar!classes2.dex)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.<clinit>(SSLConnectionSocketFactory.java:151)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.getSystemSocketFactory(SSLConnectionSocketFactory)

这是我试图验证主机名的代码：

Twilio.init(multiAccountSID,multiAccountAuthToken)
val httpClientBuilder = HttpClientBuilder.create()
httpClientBuilder.setSSLHostnameVerifier(object : HostnameVerifier{
override fun verify(hostname: String?, session: SSLSession?): Boolean {
certs = try {
session!!.peerCertificates
} catch (e: SSLException) {
return false
}
val x509: X509Certificate = certs[0] as X509Certificate
val hostName = hostname!!.trim().toLowerCase(Locale.ENGLISH)
val firstCn: String = getFirstCn(x509)
if (Pattern.matches(hostName, firstCn)) {
return true
}
for (cn in getDNSSubjectAlts(x509)) {
if (Pattern.matches(hostName, cn!!)) {
return true
}
}
return true
}
})
val verifier = SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER
val sslSocketFactory = SSLConnectionSocketFactory.getSocketFactory()

httpClientBuilder.setSSLSocketFactory(sslSocketFactory)
httpClientBuilder.build()
val networkHttpClient = NetworkHttpClient(httpClientBuilder)

val twilioRestClient = TwilioRestClient.Builder(multiAccountSID,multiAccountAuthToken).httpClient(networkHttpClient).build()
Log.d("networkHttpClient", "getAccessToken: "+networkHttpClient.lastResponse.statusCode)

但我在上出错了

val sslSocketFactory = SSLConnectionSocketFactory.getSocketFactory()

有人能帮我做错事吗？

Answer 1

Twilio Java库不是为在Android应用程序中使用而构建的。这是因为Twilio库需要您的帐户凭据才能向API发出请求，如果您的应用程序正在处理这些凭据，恶意用户可能会反编译应用程序，提取凭据并使用它们滥用您的帐户。

相反，您应该从服务器端应用程序向Twilio API发出请求，在那里您可以保护API凭据的安全，并从您的应用程序触发该请求。

这里有更多关于为什么你不应该从你的Android应用程序发出API请求的信息，以及如何构建一个服务器端应用程序来为你的应用程序发出这些请求的示例(示例是发送短信，但你可以将其切换为使用验证API(。