使用 HTTPS 向 Java 中的 API 进行身份验证请求

Question

我希望使用名为 HookTheory 的 API。我正在使用 Java 进行 HTTPS 调用，自从我第一次使用 HTTP 或 HTTPS 客户端以来，我遇到了一些障碍。

Here are the document's details on User Authentication:

You authenticate to the Hooktheory API by providing an HTTP Bearer Token, according to the OAuth 2 protocol. Your HTTP Bearer Token is retrieved through the API with your www.hooktheory.com username and password. To retrieve your HTTP Bearer Token, make the following request:

POST users/auth

The body of the request must contain your www.hooktheory.com username and password:

{  
      "username": "Hooktheory",
      "password": "0123456789"
}

The response will contain three fields, as shown below:

{  
      "id": 1234,
      "username": "Hooktheory",
      "activkey": "aoa6jjacz34kcta3aomeqwuz89"
}

The "activkey" property contains your HTTP Bearer Token; include it as an authorization header in all future requests to the API.

有人可以更详细地解释我将如何在 Java 中执行此操作吗？ 我的入门代码如下：

String url = "https://api.hooktheory.com/v1/users/auth";
    URL obj = new URL(url);
    HttpsURLConnection con = (HttpsURLConnection) obj.openConnection();

    //add request header
    con.setRequestMethod("POST");
    con.setRequestProperty("username", username);
    con.setRequestProperty("password", password);

    String urlParameters = "sn=C02G8416DRJM&cn=&locale=&caller=&num=12345";

    // Send post request
    con.setDoOutput(true);
    DataOutputStream wr = new DataOutputStream(con.getOutputStream());
    wr.writeBytes(urlParameters);
    wr.flush();
    wr.close();

    int responseCode = con.getResponseCode();
    System.out.println("\nSending 'POST' request to URL : " + url);
    System.out.println("Post parameters : " + urlParameters);
    System.out.println("Response Code : " + responseCode);

    BufferedReader in = new BufferedReader(
            new InputStreamReader(con.getInputStream()));
    String inputLine;
    StringBuffer response = new StringBuffer();

    while ((inputLine = in.readLine()) != null) {
        response.append(inputLine);
    }
    in.close();

    //print result
    System.out.println(response.toString());

这段代码基本上是copy of the code here。

我在运行上面的 post 代码时收到 401 错误（身份验证）。我猜是因为我没有正确格式化 get/post 请求。

有人能指出正确的方向吗？

Answer 1

您已将用户名和密码设置为请求属性，即 HTTP 标头。根据 HookTheory 文档，您需要在请求正文中发送这些内容。

具体来说，你需要像这样在 body 上发送 JSON 请求：

DataOutputStream wr = new DataOutputStream(con.getOutputStream());
String requestBody = String.format("{  \"username\": \"%s\", \"password\": \"%s\" }", username, password);
wr.writeBytes(requestBody);

此外，根据他们的文档，您应该通过设置 Accept 和 Content-Type 标头来表明这是 JSON。这是在通过如下调用发送发布请求数据之前完成的：

con.setRequestProperty("Accept", "application/json");
con.setRequestProperty("Content-Type", "application/json");

所以整个块看起来像：

String url = "https://api.hooktheory.com/v1/users/auth";
URL obj = new URL(url);
HttpsURLConnection con = (HttpsURLConnection) obj.openConnection();

con.setRequestMethod("POST");
con.setRequestProperty("Accept", "application/json");
con.setRequestProperty("Content-Type", "application/json");

// Send post request
con.setDoOutput(true);
DataOutputStream wr = new DataOutputStream(con.getOutputStream());
String requestBody = String.format("{  \"username\": \"%s\", \"password\": \"%s\" }", username, password);
wr.writeBytes(requestBody);
wr.flush();
wr.close();

Answer 2

代码 401 明确指出身份验证存在问题。堆栈跟踪在服务器端显示未经身份验证。

10.4.2 401 Unauthorized

The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity might include relevant diagnostic information. HTTP access authentication is explained in "HTTP Authentication: Basic and Digest Access Authentication"