Android 4.0 ICS turning HttpURLConnection GET requests into POST requests

Android 4.0 ICS: The Unexpected POST Conversion

Android 4.0 Ice Cream Sandwich (ICS) introduced a significant change in the behavior of HttpURLConnection when performing GET requests. This change, while unintentional, led to numerous headaches for developers relying on the default behavior. This article delves into the issue, its root cause, and how to mitigate its impact.

The Problem

Prior to Android 4.0, executing a GET request using HttpURLConnection would, as expected, send an HTTP GET request to the server. However, in ICS, under certain conditions, the library would unexpectedly convert the GET request into a POST request. This behavior was completely unanticipated and caused inconsistencies in server-side interactions.

The Root Cause

The unexpected behavior stemmed from a bug in the ICS version of the HttpURLConnection library. This bug specifically affected situations where a HttpURLConnection was used to connect to a secure (HTTPS) server with a self-signed certificate. In such cases, the library incorrectly interpreted the communication as a POST request.

Why Does It Happen?

This unexpected behavior occurred due to a misinterpretation of the request during the SSL handshake process. In the SSL handshake, a client (Android device) verifies the server’s certificate. When a self-signed certificate is used (not signed by a trusted Certificate Authority), the SSL handshake flow included the following steps:

• The Android device encounters the self-signed certificate, which is not trusted.
• The device prompts the user to accept the certificate, essentially choosing to trust it for this particular connection.
• During the SSL handshake, the device mistakenly flags the request as a POST request due to the acceptance of the self-signed certificate.

The Impact

This behavior significantly affected developers, as it led to unpredictable server-side responses. While the application might send a GET request, the server would receive it as a POST request. This could lead to:

• Incorrect data processing on the server-side.
• API incompatibility issues.
• Unexpected errors or failures in server-client interactions.

Mitigations and Solutions

Fortunately, several approaches can be implemented to address this issue:

1. Manually Setting the Request Method

This method involves explicitly setting the request method to GET using the setRequestMethod() function within the HttpURLConnection object. This overrides the default behavior and ensures that the server receives a GET request.

URL url = new URL("https://your_domain.com/your_path");
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
connection.setRequestMethod("GET");
// ...

2. Avoiding Self-Signed Certificates

If feasible, try to avoid using self-signed certificates when developing applications for ICS. Instead, opt for certificates issued by a trusted Certificate Authority. This eliminates the source of the misinterpretation within the SSL handshake process.

3. Upgrading to a Newer Android Version

The bug causing this behavior was addressed in later Android versions. Upgrading to a newer Android version will effectively resolve the issue.

Comparison Table

Conclusion

The unexpected POST conversion in Android 4.0 ICS for GET requests with self-signed certificates highlights the importance of understanding platform behavior and how subtle changes can impact application development. By applying the mitigations discussed, developers can avoid this issue and ensure seamless communication between their Android apps and servers.