$_POST values gone after SSL turned on

2019-03-05 15:31发布

问题:

In android, I try to send to the web server in a json structure. It works fine with http. But with https, $_POST values pairs are gone. In PHP, var_dump $_POST returns array(0) However,HttpGet works well with both http and https.

        MyHttpClient httpClient = new MyHttpClient(context);

        HttpPost httpPost = new HttpPost(url);
        httpPost.setEntity(new UrlEncodedFormEntity(params));

        HttpResponse httpResponse = httpClient.execute(httpPost);
        HttpEntity httpEntity = httpResponse.getEntity();
        is = httpEntity.getContent();

回答1:

If I set HttpClientParams.setRedirecting(params, false); Then the page returns "Temporary broken link fixed"

It sounds like you're sending your request to an http:// URL and counting on a redirection (possibly via mod_rewrite or something similar such as a redirection in the PHP code itself) to turn your page into https.

This mode of operation first makes the plain HTTP request to the server, which then tells the client that the resource has moved to the https:// address. In turn, if the automatic redirection is activated, the client makes a second request.

According to the HTTP specification, for status codes 301 or 302 (which are used for the redirection),

If the 301/302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.

Most browsers interpret this as "if the first request was a POST, don't re-send the data for the redirected request, but make the second request a GET anyway." This would explain why you lose any POSTed body for the second attempt.

Note that, for the reasons explained in this answer, over-reliance on rewrite/redirects to turn an http:// request into an https:// request should be considered bad practice.



回答2:

Try to catch raw post data in php.

$data = file_get_contents('php://input');