安卓Java开发：如何将App登录凭证提交至高校网站验证

Hey there! Since your school won't share their student database, the way to go is simulating the same login request that a web browser sends to your school's official website when a student logs in. Here's a step-by-step guide tailored for Android Java development:

Step 1: Analyze the school's login flow (critical first step!) #

First, you need to figure out exactly what your school's website expects when someone logs in. Use Chrome DevTools to inspect the login request:

• Open your school's login page in Chrome.
• Press F12 to open DevTools, then go to the Network tab.
• Check the "Preserve log" box, then enter a test Login ID and Password and click "Login".
• Look for the request that gets sent (usually a POST request to a URL like /login or /auth).
• Note down:
  • The full request URL (e.g., https://school.edu/api/auth/login)
  • The parameter names for the Login ID and Password (they might be loginId, username, studentId, password, pwd—whatever the site uses)
  • Any required request headers (like User-Agent, Referer, or Cookie—some sites require these to prevent automated requests)
  • If there's a csrf_token or similar anti-forgery token (you'll need to extract this from the login page's HTML before sending the login request)

Step 2: Implement the login request in your Android app #

For Android, the most reliable libraries for HTTP requests are OkHttp or Retrofit. Let's use OkHttp since it's straightforward for this use case.

First, add OkHttp dependency #

In your app-level build.gradle (Module level), add this to the dependencies block:

implementation 'com.squareup.okhttp3:okhttp:4.12.0'

Then, write the login verification code #

Here's a Java example that sends the login credentials to your school's website and checks the response:

import okhttp3.Call;
import okhttp3.Callback;
import okhttp3.FormBody;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.RequestBody;
import okhttp3.Response;
import android.content.Intent;
import android.os.Bundle;
import android.view.View;
import android.widget.EditText;
import android.widget.Toast;
import androidx.appcompat.app.AppCompatActivity;
import java.io.IOException;

public class LoginActivity extends AppCompatActivity {
    private EditText etLoginId, etPassword;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_login);
        etLoginId = findViewById(R.id.et_login_id);
        etPassword = findViewById(R.id.et_password);
    }

    public void onLoginClick(View view) {
        String loginId = etLoginId.getText().toString().trim();
        String password = etPassword.getText().toString().trim();

        if (loginId.isEmpty() || password.isEmpty()) {
            Toast.makeText(this, "请输入登录ID和密码", Toast.LENGTH_SHORT).show();
            return;
        }

        // Initialize OkHttp client
        OkHttpClient client = new OkHttpClient();

        // Build form data (use the parameter names you found in Step 1!)
        RequestBody formBody = new FormBody.Builder()
                .add("loginId", loginId) // Replace with actual param name from your school's site
                .add("password", password) // Replace with actual param name from your school's site
                // If there's a csrf token, add it here (you'll need to extract it first)
                // .add("_csrf", extractedCsrfToken)
                .build();

        // Build the request (use the URL and headers you found in Step 1!)
        Request request = new Request.Builder()
                .url("https://your-school-official-login-url.com/login") // Replace with actual login URL
                .post(formBody)
                .addHeader("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36") // Mimic a browser
                .addHeader("Referer", "https://your-school-official-login-url.com") // Add if required by the site
                // Add any other headers you saw in DevTools (like Cookie)
                .build();

        // Send the request asynchronously (never do network calls on the main thread!)
        client.newCall(request).enqueue(new Callback() {
            @Override
            public void onFailure(Call call, IOException e) {
                // Handle network errors (run on main thread to update UI)
                runOnUiThread(() -> {
                    Toast.makeText(LoginActivity.this, "网络连接失败，请检查网络", Toast.LENGTH_SHORT).show();
                });
                e.printStackTrace();
            }

            @Override
            public void onResponse(Call call, Response response) throws IOException {
                if (response.isSuccessful()) {
                    String responseContent = response.body().string();

                    // Check if the response indicates a successful login
                    // Replace these checks with what you saw in DevTools (e.g., a success message, or redirect to dashboard)
                    if (responseContent.contains("欢迎登录") || responseContent.contains("学生主页")) {
                        // Login successful: navigate to main app screen
                        runOnUiThread(() -> {
                            startActivity(new Intent(LoginActivity.this, MainActivity.class));
                            finish();
                        });
                    } else {
                        // Login failed: wrong credentials
                        runOnUiThread(() -> {
                            Toast.makeText(LoginActivity.this, "登录ID或密码错误", Toast.LENGTH_SHORT).show();
                        });
                    }
                } else {
                    // Server returned an error (e.g., 401 Unauthorized)
                    runOnUiThread(() -> {
                        Toast.makeText(LoginActivity.this, "登录失败，请重试", Toast.LENGTH_SHORT).show();
                    });
                }
            }
        });
    }
}

Step 3: Handle edge cases & best practices #

• Add internet permission: Don't forget to add this to your AndroidManifest.xml:

  <uses-permission android:name="android.permission.INTERNET" />
  

• HTTPS security: Ensure your school's site uses HTTPS (most do) to encrypt credentials in transit. Avoid disabling certificate validation unless absolutely necessary (it's unsafe).
• Anti-forgery tokens: If the site uses a CSRF token, you'll need to first fetch the login page's HTML, parse it to extract the token, then include it in your login request. You can use a library like Jsoup to parse HTML easily.
• Compliance: Double-check your school's terms of service to make sure simulating login requests is allowed. It's always a good idea to ask the IT department for explicit permission to avoid any issues.
• Error handling: Add more specific error cases (e.g., timeouts, server down messages) to improve user experience.

内容的提问来源于stack exchange，提问作者Atharva Pradhan