【spring cloud】对接口调用者提供API使用的安全验证微服务【这里仅通过代码展示一种设计思想】【后续可以加入redis限流的功能，某段时间某个IP可以访问API几次】

2023-02-28 14:12:02

场景：

　　公司的微服务集群，有些API 会对外提供接口，供其他厂商进行调用。这些公开的API接口，由一个OpenAPI微服务统一提供给大家。

　　那么所有的调用者在调用公开API接口的时候，需要验证是否有权限调用API 接口。

　　这套验证的工作，同样也在OpenAPI中为调用者提供验证。

==============================================================================================

简图说明：

===============================================================================================================

正文仅通过贴出来的代码展示

OpenAPI这个微服务在整个服务体系中做了什么事情

1.用户通过提供loginName和loginPwd来获取sessionKey

2.在获取sessionKey过程中，将

　　[loginName:sessionKey]

　　[sessionKey:JSON.toJSONString(userInfo)]

存入redis,并设置了有效期

3.用户每次访问接口，都要提供loginName+sign+调用API所需的参数列表

4.服务器端自定义拦截器，拦截到用户request，根据loginName取出sessionKey，按照规则生成sign

5.对比用户传入的sign和服务器端生成的sign，如果一致，则允许调用API

===============================================================================================================

代码说明：

1.pom.xml文件

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>

        <groupId>com.pisen</groupId>

        <artifactId>pisen-cloud-luna</artifactId>

        <version>1.0-SNAPSHOT</version>

    </parent>

    <artifactId>pisen-cloud-luna-ms-openapi</artifactId>

    <dependencies>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-data-jpa</artifactId>

            <!-- Spring boot 1.5.x 的 data-jpa 依赖暂时还没有 所有采用 1.4.x的 data-jpa -->

            <version>1.4.7.RELEASE</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-config</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-eureka</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-feign</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-hystrix</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <!-- 驱动 -->

        <dependency>

            <groupId>mysql</groupId>

            <artifactId>mysql-connector-java</artifactId>

            <scope>runtime</scope>

        </dependency>

        <dependency>

            <groupId>com.googlecode.log4jdbc</groupId>

            <artifactId>log4jdbc</artifactId>

            <version>1.2</version>

        </dependency>

                 <!-- ======================== 工具 ======================== END -->

        <dependency>

            <groupId>com.alibaba</groupId>

            <artifactId>fastjson</artifactId>

            <version>1.2.6</version>

        </dependency>

        <dependency>

            <groupId>org.apache.commons</groupId>

            <artifactId>commons-lang3</artifactId>

            <version>3.0</version>

        </dependency>

        <dependency>

            <groupId>com.xiaoleilu</groupId>

            <artifactId>hutool-all</artifactId>

            <version>3.1.0</version>

        </dependency>

        <dependency>

            <groupId>com.belerweb</groupId>

            <artifactId>pinyin4j</artifactId>

            <version>2.5.0</version>

        </dependency>

        <!-- ======================== 工具 ======================== END -->

        <!-- 连接池 -->

        <dependency>

            <groupId>com.alibaba</groupId>

            <artifactId>druid</artifactId>

            <version>1.0.11</version>

        </dependency>

        <!-- Redis -->

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-redis</artifactId>

            <!-- Spring boot 1.5.x 的Redis依赖暂时还没有 所有采用 1.4.x的Redis -->

            <version>1.4.7.RELEASE</version>

        </dependency>

        <dependency>

            <groupId>com.pisen</groupId>

            <artifactId>pisen-cloud-luna-core</artifactId>

            <version>${parent.version}</version>

        </dependency>

        <!--feign-->

        <dependency>

            <groupId>com.pisen</groupId>

            <artifactId>pisen-cloud-luna-feign-ten</artifactId>

            <version>${parent.version}</version>

        </dependency>

        <!-- https://mvnrepository.com/artifact/commons-codec/commons-codec -->

        <dependency>

            <groupId>commons-codec</groupId>

            <artifactId>commons-codec</artifactId>

            <version>1.4</version>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

            </plugin>

        </plugins>

    </build>

</project>

2.提供获取sessionKey的API 接口，地址是/free/sessionKey

FreeAPi

package com.pisen.cloud.luna.ms.openapi.api;

import com.pisen.cloud.luna.core.result.AjaxResult;

import com.pisen.cloud.luna.ms.openapi.base.domain.SysUser;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.RequestMethod;

/**

 * 开发者说明文档 以静态资源文件提供

 */

@RequestMapping("/free")

public interface IFreeApi {

    /**

     * 获取sessionKey

     *

     *  帐号/密码 非空

     * @param sysUser

     * @return  返回sessionkey

     * @throws Exception

     */

    @RequestMapping(value = "/sessionKey",method = RequestMethod.POST)

    public AjaxResult<String> getSessionKey(SysUser sysUser) throws Exception;

}

package com.pisen.cloud.luna.ms.openapi.api.impl;

import com.pisen.cloud.luna.core.result.AjaxResult;

import com.pisen.cloud.luna.core.result.LunaResultBean;

import com.pisen.cloud.luna.ms.openapi.base.domain.SysUser;

import com.pisen.cloud.luna.ms.openapi.api.IFreeApi;

import com.pisen.cloud.luna.ms.openapi.base.service.SysUserService;

import org.apache.commons.lang3.StringUtils;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.web.bind.annotation.RequestBody;

import org.springframework.web.bind.annotation.RestController;

@RestController

public class FreeApi implements IFreeApi {

    @Autowired

    SysUserService sysUserService;

    @Override

    public AjaxResult<String> getSessionKey(@RequestBody SysUser sysUser) throws Exception {

        AjaxResult<String> res = new AjaxResult<String>();

        LunaResultBean.checkField(sysUser, "loginName","loginPwd");

        String sessionKey = sysUserService.login(sysUser);

        if(StringUtils.isNotBlank(sessionKey)){

            res.initTrue(sessionKey);

        }else{

            res.initFalse("获取sessionKey失败:帐号密码错误", AjaxResult.ERROR_BUSINESS);

        }

        return res;

    }

}

统一响应体

package com.pisen.cloud.luna.core.result;

public class AjaxResult<T> extends LunaResultBean{

    public AjaxResult(){}

    public AjaxResult(boolean success, String msg, int code, T obj) {

        super(success,msg,code);

        this.obj = obj;

    }

    private T obj;

    public boolean isSuccess() {

        return success;

    }

    public void setSuccess(boolean success) {

        this.success = success;

    }

    public String getMsg() {

        return msg;

    }

    public void setMsg(String msg) {

        this.msg = msg;

    }

    public T getObj() {

        return obj;

    }

    public void setObj(T obj) {

        this.obj = obj;

    }

    public int getCode() {

        return code;

    }

    public void setCode(int code) {

        this.code = code;

    }

    public void initTrue(T obj){

        this.success = true;

        this.msg = "successful";

        this.code = SUCCESS_REQUEST;

        this.obj = obj;

    }

    public void initFalse(String msg, int code,T obj){

        initFalse(msg, code);

        this.obj = obj;

    }

}

package com.pisen.cloud.luna.core.result;

import java.beans.PropertyDescriptor;

import java.lang.reflect.Method;

import java.util.List;

import org.apache.commons.lang3.StringUtils;

import org.springframework.beans.BeanUtils;

import com.pisen.cloud.luna.core.enums.LunaZullErrorMSG;

import com.pisen.cloud.luna.core.exceptions.LunaException;

public class LunaResultBean {

    /**

     * 参数错误返回码

     */

    public static final int SUCCESS_REQUEST = 200;

    /**

     * 参数错误返回码

     */

    public static final int ERROR_PARAMS = 100001;

    /**

     * 业务错误返回码

     */

    public static final int ERROR_BUSINESS = 200001;

    /**

     * 系统异常返回码

     */

    public static final int ERROR_SYS_EXCPTION = 500001;

    protected boolean success;

    protected String msg;

    protected int code;

    public boolean isSuccess() {

        return success;

    }

    public void setSuccess(boolean success) {

        this.success = success;

    }

    public String getMsg() {

        return msg;

    }

    public void setMsg(String msg) {

        this.msg = msg;

    }

    public int getCode() {

        return code;

    }

    public void setCode(int code) {

        this.code = code;

    }

    public LunaResultBean() {

        super();

    }

    public LunaResultBean(boolean success, String msg, int code) {

        super();

        this.success = success;

        this.msg = msg;

        this.code = code;

    }

    public void initFalse(String msg, int code){

        throw new LunaException(msg, code);

    }

    public void initFalse2(String msg, int code){

        this.success = false;

        this.msg = msg;

        this.code = code;

    }

    public void initFalse(LunaZullErrorMSG lunaZullErrorMSG){

        this.success = false;

        this.msg = lunaZullErrorMSG.getMsg();

        this.code = lunaZullErrorMSG.getCode();

    }

    /**

     * 字段检验 方法

     * @param clazz 需要检验的对象

     * @param propertys

     * @return

     */

    public static void checkField(Object obj,String...propertys) throws LunaException{

        if(obj != null && propertys != null && propertys.length > 0){

            //字节码

            Class<? extends Object> clazz = obj.getClass();

            //遍历所有属性

            for (int i = 0; i < propertys.length; i++) {

                String property = propertys[i];

                //内省机制获取属性信息

                PropertyDescriptor pd = BeanUtils.getPropertyDescriptor(clazz,property );

                if(pd != null){

                    //获取当前字段的javabean读方法

                    Method readMethod = pd.getReadMethod();

                    if(readMethod != null){

                        Object invoke = null;

                        try {

                            invoke = readMethod.invoke(obj);

                        } catch (Exception e) {

                            throw new LunaException("方法 "+ readMethod.getName() +"无法执行",AjaxResult.ERROR_SYS_EXCPTION);

                        }

                        if(invoke != null){

                            //String类型单独处理

                            Class<?> propertyType = pd.getPropertyType();

                            if("java.lang.String".equals(propertyType.getName())){

                                if(StringUtils.isBlank((String)invoke)){

                                    throw new LunaException("错误 : [ " + property + " ] 不能为空!",AjaxResult.ERROR_PARAMS);

                                }

                            }else if("java.util.List".equals(propertyType.getName())){

                                List list = (List)invoke;

                                if(list.size() == 0){

                                    throw new LunaException("错误 : [ " + property + " ] 不能为空!",AjaxResult.ERROR_PARAMS);

                                }

                            }

                        }else{

                            throw new LunaException("错误 : [ " + property + " ] 不能为空!",AjaxResult.ERROR_PARAMS);

                        }

                    }else{

                        //抛出异常

                        throw new LunaException("在 " + clazz +"中 找不到"+"[ " + property + " ] 的 读方法",AjaxResult.ERROR_SYS_EXCPTION);

                    }

                }else{

                    //抛出异常

                    throw new LunaException("在 " + clazz +"中 找不到"+"[ " + property + " ] 属性",AjaxResult.ERROR_SYS_EXCPTION);

                }

            }

        }

    }

    /**

     * 单一字段验证

     * @param obj 需要验证的对象

     * @param property 对象字段名

     * @throws LunaException

     */

    public static void simplCheckField(Object obj,String property) throws LunaException{

        if(obj instanceof String){

            if(StringUtils.isBlank((String)obj)){

                throw new LunaException("错误 : [ " + property + " ] 不能为空!",AjaxResult.ERROR_PARAMS);

            }

        }else if(obj instanceof List){

            List list = (List)obj;

            if(list.size() == 0){

                throw new LunaException("错误 : [ " + property + " ] 不能为空!",AjaxResult.ERROR_PARAMS);

            }

        }else{

            if(obj == null){

                throw new LunaException("错误 : [ " + property + " ] 不能为空!",AjaxResult.ERROR_PARAMS);

            }

        }

    }

}

service层

package com.pisen.cloud.luna.ms.openapi.base.service.impl;

import com.pisen.cloud.luna.ms.openapi.base.dao.SysUserDao;

import com.pisen.cloud.luna.ms.openapi.base.domain.SysUser;

import com.pisen.cloud.luna.ms.openapi.base.service.SysUserService;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.stereotype.Service;

@Service

public class SysUserServiceImpl implements SysUserService {

    @Autowired

    SysUserDao sysUserDao;

    @Autowired

    RedisService redisService;

    @Override

    public String login(SysUser sysUser) {

        SysUser user = sysUserDao.findSysUserByLoginNameAndLoginPwdAndEnabled(sysUser.getLoginName(),sysUser.getLoginPwd(),1);

        String sessionKey = null;

        if (user != null){

            sessionKey = redisService.getSessionKey(user);

        }

        return sessionKey;

    }

}

需要引入的dao层和RedisService

package com.pisen.cloud.luna.ms.openapi.base.dao;

;

import com.pisen.cloud.luna.ms.openapi.base.domain.SysUser;

import feign.Param;

import org.springframework.data.jpa.repository.JpaRepository;

import org.springframework.data.jpa.repository.JpaSpecificationExecutor;

import org.springframework.data.jpa.repository.Query;

public interface SysUserDao extends JpaRepository<SysUser, Long>,JpaSpecificationExecutor<SysUser> {

    //通过 登录名 + 登录密码 + 是否启用 查找user

    SysUser findSysUserByLoginNameAndLoginPwdAndEnabled(String loginName,String loginPwd,int enable);

}

package com.pisen.cloud.luna.ms.openapi.base.service.impl;

import com.alibaba.fastjson.JSON;

import com.pisen.cloud.luna.core.utils.MD5Util;

import com.pisen.cloud.luna.ms.openapi.base.domain.SysUser;

import com.pisen.cloud.luna.ms.openapi.base.utils.MsOpenApiRedisUtil;

import org.apache.commons.lang3.StringUtils;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.data.redis.core.StringRedisTemplate;

import org.springframework.stereotype.Component;

import java.util.UUID;

import java.util.concurrent.TimeUnit;

/**

 * Redis 操作接口调用者 的 信息

 *

 */

@Component

public class RedisService {

    @Autowired

    private StringRedisTemplate redisTemplate;

    /**

     * 调用者认证信息存入在redis为[K:V],分别存入两层

     *  1.[loginName:sessionKey]

     *  2.[sessionKey:userInfo]

     *  层次存储，所以具体的存入规则为

     *  1.[MS-OPENAPI:SESSION_KEY_IN_LOGIN_NAME:loginName,sessionKey]

     *  2.[MS-OPENAPI:USER_INFO_IN_SESSION_KEY:sessionKey,JSON.toJSONString(user对象)]

     *

     * sessionKey是随机生成的，这里使用UUID生成,生成规则为

     * String key1 = 登录名+"_"+ UUID.randomUUID().toString();

     * String key2 = MD5Util.GetMD5Code(key1);

     * String key3 = MD5Util.GetMD5Code(key2+"openApi");

     * 最后的key2就是返回给调用者的sessionKey

     * 最后的key3就是redis中存储使用的sessionKey

     * @param sysUser

     * @return

     */

    public String getSessionKey(SysUser sysUser){

        String loginName = sysUser.getLoginName();

        String sessionkeyInLoginName = MsOpenApiRedisUtil.SESSION_KEY_IN_LOGIN_NAME+loginName;

        String oldSessionKey = redisTemplate.opsForValue().get(sessionkeyInLoginName);

        //如果 oldSessionKey存在

        if (StringUtils.isNotBlank(oldSessionKey)){

            //本次属于重复登录，则需要删除原本的登录信息

            redisTemplate.delete(MsOpenApiRedisUtil.USER_INFO_IN_SESSION_KEY+oldSessionKey);

        }

        //重新生成sessionKey

        String key1 = loginName+"_"+ UUID.randomUUID().toString();

        //返回给用户的sessionKey

        String key2 = MD5Util.GetMD5Code(key1);

        //redis中存储使用的sessionKey

        String key3 = MD5Util.GetMD5Code(key2+"openApi");

        //存储  用户名：sessionKey 30分钟过期

        redisTemplate.opsForValue().set(MsOpenApiRedisUtil.SESSION_KEY_IN_LOGIN_NAME+loginName,key3,30, TimeUnit.MINUTES);

        //存储  sessionKey：userInfo 30分钟过期

        redisTemplate.opsForValue().set(MsOpenApiRedisUtil.USER_INFO_IN_SESSION_KEY+key3, JSON.toJSONString(sysUser),30,TimeUnit.MINUTES);

        //返回给调用者的是 初次MD5的sessionKey,防止调用者可以直接用sessionKey获取用户信息

        return key2;

    }

    /**

     * 根据sessionKey获取用户信息

     * @param sessionKey

     * @return

     */

    public SysUser getUserInfo(String sessionKey){

        String userInfoInSessionKey = MsOpenApiRedisUtil.USER_INFO_IN_SESSION_KEY+MD5Util.GetMD5Code(sessionKey+"openApi");

        String jsonStr = redisTemplate.opsForValue().get(userInfoInSessionKey);

        if (StringUtils.isNotBlank(jsonStr)){

            try {

                SysUser sysUser = JSON.parseObject(jsonStr,SysUser.class);

                String loginName = sysUser.getLoginName();

                //重新设置过期时间为30分钟，刷新时间

                redisTemplate.expire(MsOpenApiRedisUtil.SESSION_KEY_IN_LOGIN_NAME+loginName,30,TimeUnit.MINUTES);

                redisTemplate.expire(userInfoInSessionKey,30,TimeUnit.MINUTES);

                return sysUser;

            }catch (Exception e){

                e.printStackTrace();

            }

        }

        return null;

    }

    /**

     * 取消用户登录状态

     * @param loginName

     */

    public boolean deleteSessionKey(String loginName){

        String sessionInLoginName = MsOpenApiRedisUtil.SESSION_KEY_IN_LOGIN_NAME+loginName;

        String oldSessionKey =  redisTemplate.opsForValue().get(sessionInLoginName);

        //如果用户在登录状态，则清除用户相关信息

        if (StringUtils.isNotBlank(oldSessionKey)) {

            redisTemplate.delete(MsOpenApiRedisUtil.USER_INFO_IN_SESSION_KEY+oldSessionKey);

            redisTemplate.delete(sessionInLoginName);

            return true;

        }

        return false;

    }

}

redis用到的key规则

package com.pisen.cloud.luna.ms.openapi.base.utils;

public class MsOpenApiRedisUtil {

    //redis空间名称

    private static final String NAME_SPACE = "MS-OPENAPI:";

    //通过 loginName 获取对应的 SESSION KEY

    public static final String SESSION_KEY_IN_LOGIN_NAME = NAME_SPACE + "SESSION_KEY_IN_LOGIN_NAME:";

    //通过 session key 获取对应的 用户信息

    public static final String USER_INFO_IN_SESSION_KEY = NAME_SPACE + "USER_INFO_IN_SESSION_KEY:";

}

3.spring boot项目中自定义拦截器

package com.pisen.cloud.luna.ms.openapi.api.interceptors;

import com.alibaba.fastjson.JSON;

import com.alibaba.fastjson.JSONObject;

import com.pisen.cloud.luna.core.result.AjaxResult;

import com.pisen.cloud.luna.core.result.LunaResultBean;

import com.pisen.cloud.luna.ms.openapi.api.beans.OpenApiResult;

import com.pisen.cloud.luna.ms.openapi.base.feign.tenement.client.FeignMsTenClient;

import com.pisen.cloud.luna.ms.openapi.base.utils.MsOpenApiRedisUtil;

import com.pisen.cloud.luna.ms.openapi.base.utils.OpenApiSecureUtil;

import org.apache.commons.lang3.StringUtils;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.data.redis.core.StringRedisTemplate;

import org.springframework.data.redis.core.ValueOperations;

import org.springframework.web.servlet.HandlerInterceptor;

import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.PrintWriter;

import java.util.Set;

import java.util.TreeMap;

/**

 * OpenApi拦截器

 *

 */

public class OpenApiInterceptor implements HandlerInterceptor {

    public static final String[] FREE_URIS = new String[] { "/sessionKey" };

    public static final ThreadLocal<String> OPENAPI_REQUEST_DATA = new ThreadLocal<>();

    @Autowired

    StringRedisTemplate redisTemplate;

    @Autowired

    FeignMsTenClient feignMsTenClient;

    /**

     * 该方法将在请求处理之前进行调用，只有该方法返回true，才会继续执行后续的Interceptor和Controller，

     * 当返回值为true 时就会继续调用下一个Interceptor的preHandle 方法，

     * 如果已经是最后一个Interceptor的时候就会是调用当前请求的Controller方法

     * @param httpServletRequest

     * @param httpServletResponse

     * @param o

     * @return

     * @throws Exception

     *

     * httpServletRequest 中提供 account  sign  API所需参数列表

     * redis中存储的[K,V]是 [account,sessionKey][sessionKey,JSON(用户信息)]

     * 【注意】用户提供的sign是使用 调用了API提供的getSessionKey()方法之后得到的sessionKey 再进行 MD5Util.GetMD5Code(sessionKey+"openApi")处理，再按照下面的规则生成的

     *

     * 本拦截器的作用：拦截指定路径的API调用，在调用API,进入API之前【即sign生成规则】

     * 1.从request中获取到account,根据这个用户提供的account 从redis中获取到sessionKey

     * 2.将request中除了sign之外的所有请求参数，按照字段名ASCII码字典序，从小到大排序

     * 3.将排序好的按照URL键值对的格式（即key1=value1&key2=value2…）拼接成字符串string1

     * 4.string1+sessionKey 得到string2

     * 5.对string2作md5签名成32位小写字符串，也就是进行hash一致性算法，得到服务器端[也就是本拦截器]生成的sign值

     * 6.对比服务器端sign和API调用者传进来的sign，如果签名一致，return true;允许调用API接口

     */

    @Override

    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o) throws Exception {

        //标识  是否通过拦截器往下一层拦截器走或往controller走

        boolean toNext = false;

        //URL 过滤

        String requestURI = getCleanUri(httpServletRequest.getRequestURI());

        if(StringUtils.isNotBlank(requestURI)){

            for (String freeUri : FREE_URIS) {

                // 如果当前路径中包含不需要拦截的路径的话 则放行

                if (requestURI.contains(freeUri)) {

                    toNext = true;

                }

            }

            OPENAPI_REQUEST_DATA.set(OpenApiInterceptor.getOpenApiRequestData(httpServletRequest));

        }

        OpenApiResult result = new OpenApiResult();

        if (!toNext){

            //拿到request中的数据

            String requestData = OPENAPI_REQUEST_DATA.get();

            //json序列化 request中的数据

            JSONObject jsonObject = JSON.parseObject(requestData);

            //获取 接口调用者提供的 账户名和签名

            String account = jsonObject.getString("account");

            String sign = jsonObject.getString("sign");

            if (StringUtils.isNotBlank(account) && StringUtils.isNotBlank(sign)){

                ValueOperations<String,String> operations = redisTemplate.opsForValue();

                //获取Redis中存储的本账户的sessionKey[30分钟有效期]

                String oldSessionKey = operations.get(MsOpenApiRedisUtil.SESSION_KEY_IN_LOGIN_NAME+account);

                //如果SessionKey有效 则验证 签名 sign

                if (StringUtils.isNotBlank(oldSessionKey)){

                    TreeMap<String,String> treeMap = new TreeMap<>();

                    Set<String> objSet = jsonObject.keySet();

                    for (String key: objSet){

                        if (!"sign".equals(key)){

                            //放进treeMap就是字典序排序，除了sign之外其余都要参与排序

                            treeMap.put(key,jsonObject.getString(key));

                        }

                    }

                    String createSign = OpenApiSecureUtil.getSign(treeMap,oldSessionKey);

                    if (sign.equals(createSign)){

                        toNext = true;

                    }

                }else{

                    toNext = false;

                    result.setMessage("sessionKey过期，调用失败");

                }

            }else{

                toNext = false;

                result.setMessage("account/sign无效,调用失败");

            }

        }

        if (!toNext){

            httpServletResponse.setCharacterEncoding("utf-8");

            PrintWriter printWriter = httpServletResponse.getWriter();

            printWriter.write(JSON.toJSONString(result));

        }

        httpServletResponse.setContentType("text/plain;charset=UTF-8");

        return toNext;

    }

    /**

     * 该方法将在请求处理之后，DispatcherServlet进行视图返回渲染之前进行调用，

     * 可以在这个方法中对Controller 处理之后的ModelAndView 对象进行操作

     * @param httpServletRequest

     * @param httpServletResponse

     * @param o

     * @param modelAndView

     * @throws Exception

     */

    @Override

    public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {

    }

    /**

     * 该方法也是需要当前对应的Interceptor的preHandle方法的返回值为true时才会执行，该方法将在整个请求结束之后，

     * 也就是在DispatcherServlet 渲染了对应的视图之后执行。用于进行资源清理。

     * @param httpServletRequest

     * @param httpServletResponse

     * @param o

     * @param e

     * @throws Exception

     */

    @Override

    public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {

    }

    // 获取干净的API 去除多余的/

    public static String getCleanUri(String uri) {

        String[] split = uri.split("\\/");

        StringBuffer sb = new StringBuffer();

        for (String string : split) {

            if (StringUtils.isNotBlank(string)) {

                sb.append("/" + string);

            }

        }

        return sb.toString();

    }

    /**

     * 获取request中的数据

     * @param request

     * @return

     */

    public static String getOpenApiRequestData(HttpServletRequest request){

        try {

            int contentLength = request.getContentLength();

            if (contentLength < 0) {

                return null;

            }

            byte buffer[] = new byte[contentLength];

            for (int i = 0; i < contentLength;) {

                int readlen = request.getInputStream().read(buffer, i, contentLength - i);

                if (readlen == -1) {

                    break;

                }

                i += readlen;

            }

            String charEncoding = request.getCharacterEncoding();

            if (charEncoding == null) {

                charEncoding = "UTF-8";

            }

            return new String(buffer, charEncoding);

        } catch (Exception e) {

            e.printStackTrace();

        }

        return null;

    }

}

需要返回的结构

package com.pisen.cloud.luna.ms.openapi.api.beans;

public class OpenApiResult<T> {

    private String message;

    private int result;

    private String sessionKey;

    private T object;

    public String getMessage() {

        return message;

    }

    public void setMessage(String message) {

        this.message = message;

    }

    public int getResult() {

        return result;

    }

    public void setResult(int result) {

        this.result = result;

    }

    public String getSessionKey() {

        return sessionKey;

    }

    public void setSessionKey(String sessionKey) {

        this.sessionKey = sessionKey;

    }

    public T getObject() {

        return object;

    }

    public void setObject(T object) {

        this.object = object;

    }

    public void initTrue(String token) {

        message = "调用成功";

        result = 1;

        sessionKey = token;

        object = null;

    }

    public void initTrue(String token,T object){

        message = "调用成功";

        result = 1;

        sessionKey = token;

        this.object = object;

    }

    public void initFalse(String message) {

        this.message = message;

        result = 2;

        sessionKey = "";

        object = null;

    }

}

生成sign的工具类

package com.pisen.cloud.luna.ms.openapi.base.utils;

import org.apache.commons.codec.digest.DigestUtils;

import java.io.UnsupportedEncodingException;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.util.Map;

import java.util.Set;

import java.util.TreeMap;

public class OpenApiSecureUtil {

    /**

     * 完成算法的3.4.5步 获取到服务器端自己生成的sign

     * 3.将排序好的按照URL键值对的格式（即key1=value1&key2=value2…）拼接成字符串string1

     * 4.string1+sessionKey 得到string2

     * 5.对string2作md5签名成32位小写字符串，也就是进行hash一致性算法，得到服务器端[也就是本拦截器]生成的sign值

     * @param treeMap

     * @param sessionKey

     * @return

     */

    public static String getSign(TreeMap<String,String> treeMap,String sessionKey){

        StringBuilder stringBuilder = new StringBuilder(200);

        Set<Map.Entry<String, String>> entrySet = treeMap.entrySet();

        for (Map.Entry<String, String> entry : entrySet) {

            stringBuilder.append(entry.getKey()).append("=").append(entry.getValue()).append("&");

        }

        String string = stringBuilder.substring(0, stringBuilder.length() - 1) + sessionKey;

        try {

            byte[] array = computeHash(string);

            stringBuilder.delete(0,stringBuilder.length());

            for (int i = 0; i < array.length; i++) {

                byte b = array[i];

                String text = Integer.toHexString(b & 0xFF);

                if (text.length() == 1) {

                    stringBuilder.append("0");

                }

                stringBuilder.append(text);

            }

            return stringBuilder.toString();

        } catch (NoSuchAlgorithmException e) {

            e.printStackTrace();

        }

        return null;

    }

    /**

     *  hash一致性算法

     *  对比DigestUtils.md5Hex(string);到底有什么区别

     * @param string

     * @return

     * @throws NoSuchAlgorithmException

     */

    public static byte[] computeHash(String string) throws NoSuchAlgorithmException {

        MessageDigest digest = MessageDigest.getInstance("MD5");

        digest.reset();

        byte[] utf8bytes = null;

        try {

            utf8bytes = string.getBytes("UTF-8");

            // digest.update(utf8bytes);

        } catch (UnsupportedEncodingException e) {

            e.printStackTrace();

        }

        return digest.digest(utf8bytes);

    }

}

4.把自定义的拦截器添加到配置中可以自动被加载

package com.pisen.cloud.luna.ms.openapi.init.config;

import com.pisen.cloud.luna.ms.openapi.api.interceptors.OpenApiInterceptor;

import org.springframework.context.annotation.Configuration;

import org.springframework.web.servlet.config.annotation.InterceptorRegistry;

import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration

public class OpenApiConfiguration  extends WebMvcConfigurerAdapter{

    @Override

    public void addInterceptors(InterceptorRegistry registry) {

        registry.addInterceptor(new OpenApiInterceptor()).addPathPatterns("/openApi/**").excludePathPatterns("/free/**");

        super.addInterceptors(registry);

    }

}

5.当然最后可以写一个示例，提供给调用者调用的API接口

@RestController

@RequestMapping("/openApi")

public class OpenApi {

    @RequestMapping("/test")

    public AjaxResult<String> test(){

        System.out.println(123);

        AjaxResult<String> result = new AjaxResult<>();

        result.initTrue("123");

        return result;

    }

}

整个的思想就是上面的这样。

码农公寓

相关文章