SafetyNet offline verification

Question

I am trying to follow the example here to perform an offline verification (https://github.com/googlesamples/android-play-safetynet/blob/master/server/java/src/main/java/OfflineVerify.java). However, when I tried to import the following classes, Android Studio indicated unresolved references

import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.client.json.webtoken.JsonWebSignature;
import org.apache.http.conn.ssl.DefaultHostnameVerifier;

The unresolved references were api and DefaultHostnameVerifier.

Am I missing some settings?

score 5 · Accepted Answer · answered Jun 03 '20 at 08:42

5

Because the SDK where the DefaultHostnameVerifier class is located is not synchronized in the local Android studio. You need to add the dependency of two SDKs, google-http-client-jackson2 and httpclient, in the gradle file. You can see the corresponding configuration on GitHub:

https://github.com/googlesamples/android-play-safetynet/blob/master/server/java/build.gradle

dependencies {
    compile 'com.google.http-client:google-http-client-jackson2:1.22.0'

    // Apache HttpClient is used to verify the hostname against the signed certificate in OfflineVerify.
    compile 'org.apache.httpcomponents:httpclient:4.5.2'
}

answered Jun 03 '20 at 08:42

ham

96
4

I suppose httpclient cannot be used for client side applications? I tried to use it and it says that httpclient conflicts with classes provided by Android. What if I wanted to use DefaultHostnameVerifier in my application? Do people do that or are these functions performed only on the server side? – localacct Jun 04 '20 at 09:20
You can use httpclient in the client code. There is also a DefaultHostnameVerifier class in JDK, but you only need to refer to the httpclient package when using it. I have tried it in my own project, and there is no problem in compiling. – ham Jun 11 '20 at 07:17

SafetyNet offline verification

1 Answers1