Use of Facebook key hash?

2020-06-30 02:44发布

问题:

We have to generate key hash from keystore and register it to facebook developer console.I want to understand the concept of key hash.

What benefits it provides for the server/client ?

We often see Invalid key hash error(i.e the key hash "***" does not match any stored key hashes) .So

How does my app know the correct key hash because I'm not storing it in any xml or somewhere else?

Any kind of materials or thoughts would be appreciated.

回答1:

Here Hash code is used to restrict the applications so that only valid applications (which have this particular hash code corresponds to the given certificate) can access facebook services. Because all applications are signed with particular certificates, so all the downloaded applications(say 1000 user downloads it) under same certificate must have the same hashcode and facebook is able to track which certified application used its services

We can easily find hash code of the certificate by the following code:

try {
        PackageInfo info = getPackageManager().getPackageInfo(
                "com.facebook.samples.hellofacebook", 
                PackageManager.GET_SIGNATURES);
        for (Signature signature : info.signatures) {
            MessageDigest md = MessageDigest.getInstance("SHA");
            md.update(signature.toByteArray());
            Log.d("KeyHash:", Base64.encodeToString(md.digest(), Base64.DEFAULT));
            }
    } catch (NameNotFoundException e) {

    } catch (NoSuchAlgorithmException e) {

    }

Above we are using SHA(Secure Hash Algorithm) to generate Hash code of the certificate.

SHA (Secure Hash Algorithm ) is message-digest algorithm, which takes an input message of any length and produces a 160-bit output as the message digest. SHA is called secure because it is computationally infeasible to find a message which corresponds to a given message digest, or to find two different messages which produce the same message digest.

So before making any real request to Facebook server , first hash key of certificate is compared with the stored hash key(i.e development hash key or debug hash key) on the server and if they match only then we can proceed further.