Web Application Firewall:Integrate the App Protection SDK for Android

5a. (Optional) Set the user ID

Call setAccount() to associate a user ID with SDK requests. This helps WAF apply user-level protection policies. Skip this call if the user is not logged in — call init() directly instead.

// Signature: int setAccount(String account)
// Returns: 0 on success, -1 on failure

final String account = "account"; // Use a masked user ID
TigerTallyAPI.setAccount(account);

5b. Initialize the SDK

Call init() once when your app starts. This performs a one-time collection of device information used for risk analysis.

Two collection modes are available:

• `DEFAULT`: Collects all device data, including sensitive fields (imei, imsi, simSerial, wifiMac, wifiList, bluetoothMac). Requires the corresponding permissions. Use this mode after the user has accepted the app's privacy policy.

• `NOT_GRANTED`: Skips sensitive fields. Use this mode before the user has accepted the privacy policy.

// Signature: int init(Context context, String appkey, int type)
// Returns: 0 on success, -1 on failure

final String appkey = "your_appkey";

// Full data collection (after user accepts privacy policy)
int ret = TigerTallyAPI.init(this.getApplicationContext(), appkey, TigerTallyAPI.CollectType.DEFAULT);

// Exclude sensitive fields (before user accepts privacy policy)
int ret = TigerTallyAPI.init(this.getApplicationContext(), appkey, TigerTallyAPI.CollectType.NOT_GRANTED);

Log.d("AliSDK", "ret:" + ret);

5c. Sign the request

Call vmpSign() before each outgoing HTTP request. Pass the request body as a byte array; for GET requests or empty POST bodies, pass null or "".getBytes("UTF-8").

// Signature: String vmpSign(int signType, byte[] input)
// Returns: the wToken signature string

String request_body = "i am the request body, encrypted or not!";
String wToken = null;
try {
    wToken = TigerTallyAPI.vmpSign(1, request_body.getBytes("UTF-8"));
} catch (UnsupportedEncodingException e) {
    e.printStackTrace();
}
Log.d("AliSDK", "wToken:" + wToken);

5d. Add the signature to the HTTP header

Set the wToken value as an HTTP header property before sending the request. The following example uses HttpURLConnection:

String request_body = "i am the request body, encrypted or not!";
new Thread(new Runnable() {
    @Override
    public void run() {
        try {
            URL url = new URL("https://www.aliyundoc.com");
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
            conn.setReadTimeout(5000);
            conn.setRequestMethod("POST");
            // Add the wToken signature to the request header
            conn.setRequestProperty("wToken", wToken);
            OutputStream os = conn.getOutputStream();
            // Write the request body
            byte[] requestBody = request_body.getBytes("UTF-8");
            os.write(requestBody);
            os.flush();
            os.close();
            int code = conn.getResponseCode();
            Log.d("respCode", Integer.toString(code));
        } catch (MalformedURLException e) {
            e.printStackTrace();
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        } catch (ProtocolException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}).start();