令牌提交的身份验证失败_您确定您没有将用户的身份验证令牌泄漏给第三方吗？

令牌提交的身份验证失败

Are you an Android developer who is inclined towards security or an application security guy who’s keen to connect multiple dots to identify a cool security bug? Were you oblivious that OkHttp, the Friend of Android developers retains auth headers during redirection? If yes, then this story would be interesting for you. It talks about the behaviour of OkHttp to retain auth headers during redirection to third-party domains.

您是倾向于安全性的Android开发人员，还是热衷于连接多个点以识别很酷的安全性错误的应用程序安全性专家？ 您是否忘记了Android开发者之友OkHttp在重定向期间保留auth标头？ 如果是 ，那么这个故事对您来说很有趣。 它讨论了OkHttp在重定向到第三方域期间保留身份验证标头的行为。

To better understand this, let us first brush up some fundamental things around the issue. If you are already aware of OkHttp and concept of application and network Interceptors, you may skip the following sections and directly start from The Problem!

为了更好地理解这一点，让我们首先回顾一下有关此问题的一些基本知识。 如果您已经了解OkHttp以及应用程序和网络拦截器的概念，则可以跳过以下部分，直接从问题开始！

什么是OkHttp？ (What is OkHttp?)

OkHttp is an HTTP client, it is a third-party library developed by Square for sending and receiving HTTP-based network requests. It is also the underlying library for Retrofit which is another HTTP client used widely these days.

OkHttp是一个HTTP客户端，它是Square开发的用于发送和接收基于HTTP的网络请求的第三方库。 它也是Retrofit的基础库，这是当今广泛使用的另一个HTTP客户端。

OkHttp拦截器 (OkHttp Interceptors)

Interceptors are a powerful mechanism that can monitor, rewrite, and retry network calls. For large-scale applications where we have numerous APIs communicating with our backend, it can be tedious and super-repetitive to write common logics such as encrypting the request body, decrypting the response body, attaching access tokens to request, handling specific responses(e.g. HTTP-401-Unauthorized/HTTP-403-Forbidden), etc. for each and every API call and this is where Interceptors helps us to rescue.

拦截器是一种强大的机制，可以监视，重写和重试网络调用。 对于我们有大量与后端通信的API的大型应用程序，编写通用逻辑(例如加密请求正文，解密响应正文，将访问令牌附加到请求，处理特定响应(例如， HTTP-401-Unauthorized / HTTP-403-Forbidden)等等，Interceptor可以帮助我们进行救援。

The way we have API Gateway at the backend which acts as an entry point from the backend side, we can consider Interceptors to be the gateway for all the request that our frontend makes.

在后端使用API​​网关作为后端的入口点的方式，我们可以将Interceptor视为前端提出的所有请求的网关 。

申请与 网络拦截器 (Application Vs. Network Interceptors)

The OkHttp Interceptors can be registered as either Application or Network interceptors as shown below:

所述OkHttp拦截器可以注册为是A pplication或N etwork 拦截器如下图所示：