devbox
小舞很执着
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

七、api接口安全设计_接口安全性设计

作者：小舞很执着 | 2024-07-19 22:12:51

赞

踩

接口安全性设计

参考 API安全接口安全设计

参考 系列学习互联网安全架构第 3 篇 —— 自定义注解，防止表单重复提交

参考 安全|API接口安全性设计（防篡改和重复调用）

参考 API接口安全设计

参考 数据加密之RSA

参考 这个轮子让SpringBoot实现api加密So Easy

为什么要设计安全的api接口

运行在外网服务器的接口暴露在整个互联网中，可能会受到各种攻击，例如恶意爬取服务器数据、恶意篡改请求数据等，因此需要一个机制去保证api接口是相对安全的。

本项目api接口安全设计

本项目api接口的安全性主要是为了请求参数不会被篡改和防止接口被多次调用而产生脏数据，实现方案主要围绕令牌(token)、时间戳(timestamp)、签名(signature)三个机制展开设计。

模拟前端签名与后端验证签名

RSA密钥对生成

KeyPairGenerator生成RSA密钥对

自定义Generator密钥生成器：

  1. package com.admin.utils;
  2.  
  3. import java.security.KeyPair;
  4. import java.security.KeyPairGenerator;
  5. import java.security.interfaces.RSAPrivateKey;
  6. import java.security.interfaces.RSAPublicKey;
  7.  
  8. import org.apache.tomcat.util.codec.binary.Base64;
  9.  
  10. /**
  11.  * 描述：密钥生成器
  12.  */
  13.  
  14. public class Generator {
  15.  
  16.     public static final String ALGORITHM_RSA = "RSA";
  17.  
  18.     private static final String RSA_CHARSET = "UTF-8";
  19.  
  20.     public static void main(String[] args) throws Exception {
  21.         KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance(ALGORITHM_RSA);
  22.         keyPairGen.initialize(1024);
  23.         // 生成密钥对
  24.         KeyPair keyPair = keyPairGen.generateKeyPair();
  25.         // 获取公钥
  26.         RSAPublicKey rsaPublicKey = (RSAPublicKey) keyPair.getPublic();
  27.         byte[] keyBs = rsaPublicKey.getEncoded();
  28.         String publicKey = encodeBase64(keyBs);
  29.         System.out.println("生成的公钥：\r\n" + publicKey);
  30.         // 获取私钥
  31.         RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();
  32.         keyBs = rsaPrivateKey.getEncoded();
  33.         String privateKey = encodeBase64(keyBs);
  34.         System.out.println("生成的私钥：\r\n" + privateKey);
  35.  
  36.     }
  37.  
  38.     /**
  39.      * 描述：byte数组转String
  40.      *
  41.      * @param source
  42.      * @return
  43.      * @throws Exception
  44.      */
  45.     public static String encodeBase64(byte[] source) throws Exception {
  46.         return new String(Base64.encodeBase64(source), RSA_CHARSET);
  47.     }
  48.  
  49.     /**
  50.      * 描述：String转byte数组
  51.      *
  52.      * @param target
  53.      * @return
  54.      * @throws Exception
  55.      */
  56.  
  57.     public static byte[] decodeBase64(String target) throws Exception {
  58.         return Base64.decodeBase64(target.getBytes(RSA_CHARSET));
  59.     }
  60.  
  61. }

测试效果：

  1. 生成的公钥：
  2. MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCoewDlVLsRQoYulINY2Szh89jWA0J7KB2RPdcMKWpX1WCPcw3wB8q/7bBrJFYr2899V59QcJpd7LRf6hEjLmjaz+7QzDhWFz2x11kqROmy0+PWt+SiSlRkGGWmfQGwUF8waAB/fzaQ5V0naDDF48XbAcvAR7DKOnYBcwpRhEHd3wIDAQAB
  3. 生成的私钥：
  4. MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKh7AOVUuxFChi6Ug1jZLOHz2NYDQnsoHZE91wwpalfVYI9zDfAHyr/tsGskVivbz31Xn1Bwml3stF/qESMuaNrP7tDMOFYXPbHXWSpE6bLT49a35KJKVGQYZaZ9AbBQXzBoAH9/NpDlXSdoMMXjxdsBy8BHsMo6dgFzClGEQd3fAgMBAAECgYAXH8LQtx9x0AKgtAuPD0fEv3Y8cXgXdTsRqz4v0iNhaMz3A2CfWEJws0vqeLNHE8VXu8YHAV1+lLVxEKxHeuAzJjJlekGSTZAkfgF4Xm5mdfGuhVRF4ldHHbguQ5oT+OhdsxC3mMAUIwSjAkhuqEU/tK3quZeKt4Z/V3s2qa4fiQJBAPjtQSjHmnhEHayIaIiyWm/Nu+d3plq3tZsu1Mz8yj4oTPQ/rt4MvcMbI2G/tSXh1fzWmleQDlc1sATP27lzdn0CQQCtRJDX+gJejoJ9PMf/0Nzrqr1LH64UaBL0MrFc58vGN0UHtMkwKC1g58R5x006b3m8pp1mUNKutR9tMB/80SiLAkEArqECzTD6VNS0XI11iDBW8YhLAh8WPR4T8UHxV70fxGtRUSg77NrTZURsle5/jovYKwACVttgtB2d1kJbysYNoQJAZ/coYi+llE82hScfaqRMqyv8AUO1FJGOLfDs864yW3F2fjVAMyEoeWkYP2oTMOkKxuPCtk3w3NvZS48A4pYuGQJALU19SKEWk+JGC8tIOdO/tE2rSp/Uc+S/trbOkmSD0vA8sCetJ4jth68eNf60csGXDF2s4fZnc/8vyhkyX51gtg==

使用keytool生成RSA密钥对

keytool口令：生成一个名称为jwt.jks、别名为jwt的RSA密钥证书

keytool -genkey -alias jwt -keyalg RSA -keystore jwt.jks

测试类：

  1. package com.jwt.test;
  2.  
  3. import com.alibaba.nacos.common.codec.Base64;
  4. import lombok.extern.slf4j.Slf4j;
  5. import org.junit.Test;
  6. import org.junit.runner.RunWith;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.boot.test.context.SpringBootTest;
  9. import org.springframework.context.annotation.Bean;
  10. import org.springframework.context.annotation.Configuration;
  11. import org.springframework.core.io.ClassPathResource;
  12. import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;
  13. import org.springframework.test.context.junit4.SpringRunner;
  14.  
  15. import java.security.KeyPair;
  16. import java.security.interfaces.RSAPrivateKey;
  17. import java.security.interfaces.RSAPublicKey;
  18.  
  19. @Slf4j
  20. @SpringBootTest
  21. @RunWith(SpringRunner.class)
  22. public class SecurityUtilTest {
  23.  
  24.     @Configuration
  25.     public static class KeyPairConfig {
  26.         @Bean
  27.         public KeyPair keyPair() {
  28.             //从classpath下的证书中获取秘钥对
  29.             KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(new ClassPathResource("jwt.jks"), "yushanma".toCharArray());
  30.             return keyStoreKeyFactory.getKeyPair("jwt", "yushanma".toCharArray());
  31.         }
  32.     }
  33.  
  34.     @Autowired
  35.     private KeyPair keyPair;
  36.  
  37.     @Test
  38.     public void test() throws Exception {
  39.         RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
  40.         log.info("公钥信息 => \n {} \n 公钥:{}", publicKey.toString(), encodeBase64(publicKey.getEncoded()));
  41.  
  42.         RSAPrivateKey priKey = (RSAPrivateKey) keyPair.getPrivate();
  43.         log.info("私钥信息 => \n {} \n 私钥:{}", priKey.toString(), encodeBase64(priKey.getEncoded()));
  44.     }
  45.  
  46.     /**
  47.      * byte数组转String
  48.      *
  49.      * @param source
  50.      * @return
  51.      * @throws Exception
  52.      */
  53.     public static String encodeBase64(byte[] source) throws Exception {
  54.         return new String(Base64.encodeBase64(source), "UTF-8");
  55.     }
  56.  
  57. }

测试效果：

  1. 2021-06-27 19:16:56.763  INFO [service-oauth2-auth,,,] 9660 --- [           main] com.jwt.test.SecurityUtilTest            : 公钥信息 => 
  2.  Sun RSA public key, 2048 bits
  3.   params: null
  4.   modulus: 20567319899170327840617709116508613419444179747880097355983274966140263504127642335368881422806411882720105980898002775462182893840998598143067464437617108429341174218868746433850709448012734699906126672691529515616716370127079548559157542234879717092569729835437000192116554597443494711257376818024341910971296796534185532013474935580582324311859637511618273147841849708608228263695599394403252262972361043417011840182980810496043340558930295790493636277300954108517771868053504903170991016889800274282430555222393346553171856856567070173388221305727470309637173891604587252568686869543168050575459512799421310277329
  5.   public exponent: 65537 
  6.  公钥:MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAouyvwqbhaqIdIU4kRYTv43j04XtmGZywCcdV3I+Zer6hNHRad5hhN69WSEzFlTiXx2/6ktBwtNSM8wRCNjC3RQFK8BNSkaapHN5X7uQeP4TVrsl+/ow4D0Hgc6+GBcAYjKdXdxv4rkuy7s+mQVgCCA2zra4bopAZCKS6uM1f/C1Ki7UTCmTiM7LQdKSQsAio7MjZSKX6T1FAmr7AhjXxxUO80h8YInyboIhc7OyGevhicw7ebciVcz0ATRBrC/9Y4sf4OQV5t+g92vqcVGt2Rhczh8gQnEETVipAlH0W/syF0Xu2zr6HBtOxGP30Szg9jAytX4cL3G3WCwv47+WW0QIDAQAB
  7. 2021-06-27 19:16:56.766  INFO [service-oauth2-auth,,,] 9660 --- [           main] com.jwt.test.SecurityUtilTest            : 私钥信息 => 
  8.  SunRsaSign RSA private CRT key, 2048 bits
  9.   params: null
  10.   modulus: 20567319899170327840617709116508613419444179747880097355983274966140263504127642335368881422806411882720105980898002775462182893840998598143067464437617108429341174218868746433850709448012734699906126672691529515616716370127079548559157542234879717092569729835437000192116554597443494711257376818024341910971296796534185532013474935580582324311859637511618273147841849708608228263695599394403252262972361043417011840182980810496043340558930295790493636277300954108517771868053504903170991016889800274282430555222393346553171856856567070173388221305727470309637173891604587252568686869543168050575459512799421310277329
  11.   private exponent: 19303536124600864633358183739817886254024619623908704828822363598689100937468777637800630122172549779607148921754675232596531269361731903684637376406576870157144447048272221693793691169068820840002225485409096853770911453476916292046840417212680644496451837621156444173781059146569866788065386698760658421102988458584474980507935585707721550065745072389564711878488207910700168001180802928703831440170322346912658552971247917296991274641100029517759307731419438082221755651445909904889771910842153508992367099498241878354429306538249813955752652096678699781581144570632109930711682397263860234110176066187681387955073 
  12.  私钥:MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCi7K/CpuFqoh0hTiRFhO/jePThe2YZnLAJx1Xcj5l6vqE0dFp3mGE3r1ZITMWVOJfHb/qS0HC01IzzBEI2MLdFAUrwE1KRpqkc3lfu5B4/hNWuyX7+jDgPQeBzr4YFwBiMp1d3G/iuS7Luz6ZBWAIIDbOtrhuikBkIpLq4zV/8LUqLtRMKZOIzstB0pJCwCKjsyNlIpfpPUUCavsCGNfHFQ7zSHxgifJugiFzs7IZ6+GJzDt5tyJVzPQBNEGsL/1jix/g5BXm36D3a+pxUa3ZGFzOHyBCcQRNWKkCUfRb+zIXRe7bOvocG07EY/fRLOD2MDK1fhwvcbdYLC/jv5ZbRAgMBAAECggEBAJjp2JSzGEKC4SBPPQ/ak2RGNGAk91D2lOq4okeep4hivt6Cjh5NcIFZGXxGQfOp6BqRaPa+l+nAzIGR76r40in76p+lIwv9BiBINvPKOvGW9Q9VotG6PStkwwsRJJLlFqV8skTihebguZIWZo5R0aZJZeiOzvUmlbhdE7s7VulQ+8E24YcBUuwXGwOGFtmwymnCLZDPcjWZMWsujxEjPOoEqkUGCFDSKi7t9Ydi/D6yBhkAv7jnZggY1CnMfCt2M9nkpW6AUde+YPlKAKFltSNvEJnuYir9LI645wYUz5E8up13p4vvrDL+2X2CEwbVwEISw4aN36xqY7+J+30iw4ECgYEA8x0PcoNYv2lZlo5Tnu94aIWTEog6DhA6qykX4GUxd4P6vHsKyfIqGl1uDizhZNAOMu89wrENRWaJaSU0ZF5C37aCihizeNHbyR9gk/CkUeBaphCckTUvQcu9O784L39/OXKsGYcSmJRyVzknLVo+R+ZNrfvVjr2aLxvaQEyfb3kCgYEAq49/okjKL7QB2JufJ1eRZDoK2mROPntSc/bAFD7wwhWpX6hpD8XiGpMWBvnxKaKIE9EzPDXDnbJTbqhV3MbQfrudOYGk0OlPiO+pzoqft9uknPGXzqPT/8nY9q/QAW8nBp++hXNTO19/VwJtJ0+hye5q2FyamOM4K5NABpHAVBkCgYEAjx5beqlyNHTbhbNR7O3C7507AJzruF27fAmcAcDwxxAOKqkwp8QFHzJDWNr48XU99qQ6soOycVm0qQ568l8/dR2naY6zEPxSK+tp2o2+3mh6VOrQkPdDU7OSOjsO439mMTadtAV9YA975HdD5gILSh59OmBXz0k1HGiEKngxH9kCgYAXXRJ3qkwGlRAPTJovBGjjalgiB7j0H11KN5dO6odlFwga49dy83LoRZGhX5ZtIhpAAKRmlbfPGQLttfUDfPvV1n0B4NruLGfNcT4Bx7Ual8niKbCPzpXHZtiqN6UvHNEGwOh0ShFSq52u3sC4ssqIsnRQhMP1ADSdEo+MlXrIuQKBgFIZD+xT/fEw2O6UQ/4FJy3cIqV/6gAxwtFI4VlztEIG44TSlm9IA9WopMazuuwOZKSbb61/EVnYDQIovEE7V0DNu830cejxmREcL8xa6+rR2R6TsjEYCxxX3Gt6gP4RqrI/pZpmknqEjs+FbXRx+ThPWxWhKbAb2qiKVZNWt/Cx
  13.

新增一个签名模块模拟签名与验证

依赖：

  1.      <dependencies>
  2.         <!--        springboot-web-->
  3.         <dependency>
  4.             <groupId>org.springframework.boot</groupId>
  5.             <artifactId>spring-boot-starter-web</artifactId>
  6.         </dependency>
  7.         <!--nacos客户端-->
  8.         <dependency>
  9.             <groupId>com.alibaba.cloud</groupId>
  10.             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
  11.         </dependency>
  12.         <!--fegin组件-->
  13.         <dependency>
  14.             <groupId>org.springframework.cloud</groupId>
  15.             <artifactId>spring-cloud-starter-openfeign</artifactId>
  16.         </dependency>
  17.         <!-- Feign Client for loadBalancing -->
  18.         <dependency>
  19.             <groupId>org.springframework.cloud</groupId>
  20.             <artifactId>spring-cloud-loadbalancer</artifactId>
  21.         </dependency>
  22.         <!--        注解-->
  23.         <dependency>
  24.             <groupId>org.projectlombok</groupId>
  25.             <artifactId>lombok</artifactId>
  26.             <version>1.18.20</version>
  27.             <scope>provided</scope>
  28.         </dependency>
  29.         <!--        容错组件sentinel-->
  30.         <dependency>
  31.             <groupId>com.alibaba.cloud</groupId>
  32.             <artifactId>spring-cloud-starter-alibaba-sentinel</artifactId>
  33.         </dependency>
  34.     </dependencies>

将密钥证书放到resource目录：

主类：

  1. package com.sign;
  2.  
  3. import org.springframework.boot.SpringApplication;
  4. import org.springframework.cloud.client.SpringCloudApplication;
  5.  
  6. @SpringCloudApplication
  7. public class SignApplication {
  8.  
  9.     public static void main(String[] args) {
  10.         SpringApplication.run(SignApplication.class);
  11.     }
  12. }

封装的安全工具类：

  1. package com.sign.util;
  2.  
  3.  
  4. import org.apache.tomcat.util.codec.binary.Base64;
  5. import org.springframework.core.io.ClassPathResource;
  6. import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;
  7.  
  8. import javax.crypto.Cipher;
  9. import java.security.KeyFactory;
  10. import java.security.KeyPair;
  11. import java.security.PrivateKey;
  12. import java.security.PublicKey;
  13. import java.security.spec.PKCS8EncodedKeySpec;
  14. import java.security.spec.X509EncodedKeySpec;
  15.  
  16. /**
  17.  * 描述：安全工具类
  18.  */
  19.  
  20. public final class SecurityUtil {
  21.  
  22.     private static final String ALGORITHM_RSA = "RSA";
  23.  
  24.     private static final String RSA_CHARSET = "UTF-8";
  25.  
  26.     /**
  27.      * 描述：将字符串通过RSA算法公钥加密
  28.      *
  29.      * @param content 需要加密的内容
  30.      * @param pubKey  公钥
  31.      * @return 加密后字符串
  32.      * @throws Exception
  33.      */
  34.     private static String EncryptByRSAPubKey(String content, String pubKey) throws Exception {
  35.         try {
  36.             PublicKey publicKey = SecurityUtil.getRSAPubKey(pubKey);
  37.             Cipher cipher = Cipher.getInstance(publicKey.getAlgorithm());
  38.             cipher.init(Cipher.ENCRYPT_MODE, publicKey);
  39.             cipher.update(content.getBytes(RSA_CHARSET));
  40.             return SecurityUtil.encodeBase64(cipher.doFinal());
  41.  
  42.         } catch (Exception e) {
  43.             e.printStackTrace();
  44.             throw new Exception();
  45.  
  46.         }
  47.  
  48.     }
  49.  
  50.     /**
  51.      * 描述：将字符串通过RSA算法公钥解密
  52.      *
  53.      * @param content 需要解密的内容
  54.      * @param pubKey  公钥
  55.      * @return 解密后字符串
  56.      * @throws Exception
  57.      */
  58.     public static String DecryptByRSAPubKey(String content, String pubKey) throws Exception {
  59.         try {
  60.             PublicKey publicKey = SecurityUtil.getRSAPubKey(pubKey);
  61.             Cipher cipher = Cipher.getInstance(publicKey.getAlgorithm());
  62.             cipher.init(Cipher.DECRYPT_MODE, publicKey);
  63.             cipher.update(SecurityUtil.decodeBase64(content));
  64.             return new String(cipher.doFinal(), RSA_CHARSET);
  65.         } catch (Exception e) {
  66.             e.printStackTrace();
  67.             throw new Exception();
  68.         }
  69.     }
  70.  
  71.     /**
  72.      * 描述：将字符串通过RSA算法私钥加密
  73.      *
  74.      * @param content 需要加密的内容
  75.      * @param priKey  私钥
  76.      * @return 加密后字符串
  77.      * @throws Exception
  78.      */
  79.     public static String EncryptByRSAPriKey(String content, String priKey) throws Exception {
  80.         try {
  81.             PrivateKey privateKey = SecurityUtil.getRSAPriKey(priKey);
  82.             Cipher cipher = Cipher.getInstance(privateKey.getAlgorithm());
  83.             cipher.init(Cipher.ENCRYPT_MODE, privateKey);
  84.             cipher.update(content.getBytes(RSA_CHARSET));
  85.             return SecurityUtil.encodeBase64(cipher.doFinal());
  86.  
  87.         } catch (Exception e) {
  88.             e.printStackTrace();
  89.             throw new Exception();
  90.  
  91.         }
  92.  
  93.     }
  94.  
  95.     /**
  96.      * 描述：将字符串通过RSA算法私钥解密
  97.      *
  98.      * @param content 需要解密的内容
  99.      * @param priKey  私钥
  100.      * @return 解密后字符串
  101.      * @throws Exception
  102.      */
  103.     public static String DecryptByRSAPriKey(String content, String priKey) throws Exception {
  104.         try {
  105.             PrivateKey privateKey = SecurityUtil.getRSAPriKey(priKey);
  106.             Cipher cipher = Cipher.getInstance(privateKey.getAlgorithm());
  107.             cipher.init(Cipher.DECRYPT_MODE, privateKey);
  108.             cipher.update(SecurityUtil.decodeBase64(content));
  109.             return new String(cipher.doFinal(), RSA_CHARSET);
  110.  
  111.         } catch (Exception e) {
  112.             e.printStackTrace();
  113.             throw new Exception();
  114.  
  115.         }
  116.  
  117.     }
  118.  
  119.     /**
  120.      * 获取密钥对
  121.      *
  122.      * @return
  123.      */
  124.     private static KeyPair getKeyPair() {
  125.         //从classpath下的证书中获取秘钥对
  126.         KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(new ClassPathResource("jwt.jks"), "yushanma".toCharArray());
  127.         return keyStoreKeyFactory.getKeyPair("jwt", "yushanma".toCharArray());
  128.     }
  129.  
  130.     /**
  131.      * 获取公钥字符串
  132.      *
  133.      * @return
  134.      * @throws Exception
  135.      */
  136.     public static String getPublicKey() throws Exception {
  137.         // 获取密钥对
  138.         KeyPair keyPair = getKeyPair();
  139.         // 获取私钥信息
  140.         PublicKey publicKey = keyPair.getPublic();
  141.         // byte 转 String
  142.         return encodeBase64(publicKey.getEncoded());
  143.     }
  144.  
  145.     /**
  146.      * 获取私钥字符串
  147.      *
  148.      * @return
  149.      * @throws Exception
  150.      */
  151.     public static String getPrivateKey() throws Exception {
  152.         // 获取密钥对
  153.         KeyPair keyPair = SecurityUtil.getKeyPair();
  154.         // 获取私钥信息
  155.         PrivateKey privateKey = keyPair.getPrivate();
  156.         // byte 转 String
  157.         return SecurityUtil.encodeBase64(privateKey.getEncoded());
  158.     }
  159.  
  160.     /**
  161.      * 描述：获取RSA公钥
  162.      *
  163.      * @return PublicKey
  164.      * @throws Exception
  165.      */
  166.     private static PublicKey getRSAPubKey(String pubKey) throws Exception {
  167.         try {
  168.             X509EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(SecurityUtil.decodeBase64(pubKey));
  169.             KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA);
  170.             return keyFactory.generatePublic(publicKeySpec);
  171.  
  172.         } catch (Exception e) {
  173.             e.printStackTrace();
  174.             throw new Exception();
  175.  
  176.         }
  177.  
  178.     }
  179.  
  180.     /**
  181.      * 描述：获取RSA私钥
  182.      *
  183.      * @param priKey 私钥
  184.      * @return PrivateKey
  185.      * @throws Exception
  186.      */
  187.     private static PrivateKey getRSAPriKey(String priKey) throws Exception {
  188.         try {
  189.             PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(SecurityUtil.decodeBase64(priKey));
  190.             KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA);
  191.             return keyFactory.generatePrivate(privateKeySpec);
  192.  
  193.         } catch (Exception e) {
  194.             e.printStackTrace();
  195.             throw new Exception();
  196.  
  197.         }
  198.  
  199.     }
  200.  
  201.     /**
  202.      * base64编码
  203.      *
  204.      * @param source
  205.      * @return
  206.      * @throws Exception
  207.      */
  208.     public static String encodeBase64(byte[] source) throws Exception {
  209.         return new String(Base64.encodeBase64(source), RSA_CHARSET);
  210.  
  211.     }
  212.  
  213.     /**
  214.      * Base64解码
  215.      *
  216.      * @param target
  217.      * @return
  218.      * @throws Exception
  219.      */
  220.     public static byte[] decodeBase64(String target) throws Exception {
  221.         return Base64.decodeBase64(target.getBytes(RSA_CHARSET));
  222.  
  223.     }
  224.  
  225.     public static void main(String[] args) throws Exception {
  226.  
  227.         String pubKey = getPublicKey();
  228.  
  229.         String priKey = getPrivateKey();
  230.  
  231.         String content = "age=18&name=yushanma";
  232.         String s = EncryptByRSAPubKey(content, pubKey);
  233.         System.out.println("公钥加密后：" + s);
  234.         System.out.println("私钥解密后：" + DecryptByRSAPriKey(s, priKey));
  235.  
  236.         content = "age=18&name=yushanma";
  237.         s = EncryptByRSAPriKey(content, priKey);
  238.         System.out.println("私钥加密后：" + s);
  239.         System.out.println("公钥解密后：" + DecryptByRSAPubKey(s, pubKey));
  240.  
  241.     }
  242. }

测试：

  1. 公钥加密后：Gx9epQIqlKTHaV7a57eUkGQ02egvT1FhvD0vblqau1ncmB8ZgyNTu29gM6N+UdgoNkQZyPYx490tekmttk6B6q307rY2P+7ADtJ0L4ZUflCTCrihYdFROtMI0ZdHd/zCOw47FE7n9IsChjpHdIvngJ7cvVCtzejC5E0w1lpH/5/Nb0JT3cEqdi6sI7ybePyq+jg5FQwmOloxKHJ8X1GxqxqVX7LgKBvpZsMrTnyZ9gJeWSbRhZXDe5de0TvOabdMvEPHxFaq3nqOM+seFSk1TLG/LRvAwJizetVV/RWCfz9hAFMZ+f2ThCS547zghuXGRqCNsARa/YumRexehpkNZQ==
  2. 私钥解密后：age=18&name=yushanma
  3. 私钥加密后：ci6hNfue3LWLhn3LLmEnKchtWOznTPi7bnhOta6JyxoFx8aMnSWKgsbc4+eW9KtTH9NC05Ol1z8ksur5PpyAy16en7P4fGubq3m8fRW44gxU3Lbwz/rSMJNu3YK/P/E2rXdg8i0MtGynhfQj6ox48PXCGjjaKW0U0YUWndArmd/aebJD3nERVuYfS/2l+o9slWWqKVDzjqSSoqLG31gfYtykDEjscSG5zEUGBO/vDdETcdmIHpzJOAEe6oMvpDogniFDl9br/9W8nFc/8C082yexYggIqlJoWpjF66ywfhefQMj5olT3M9sAJCrhzdlnLi8kvtTd/83c9HUk3Ui+fw==
  4. 公钥解密后：age=18&name=yushanma

封装签名工具类：

  1. package com.sign.util;
  2.  
  3.  
  4. import com.alibaba.csp.sentinel.util.StringUtil;
  5. import lombok.extern.slf4j.Slf4j;
  6. import org.apache.commons.codec.digest.DigestUtils;
  7.  
  8. import java.io.UnsupportedEncodingException;
  9. import java.net.URLDecoder;
  10. import java.net.URLEncoder;
  11. import java.util.*;
  12.  
  13. @Slf4j
  14. public class ApiUtil {
  15.  
  16.     /**
  17.      * 参数排序
  18.      *
  19.      * @param data
  20.      * @return
  21.      */
  22.     private static String getSortedContent(Map<String, String> data) {
  23.         StringBuffer content = new StringBuffer();
  24.         List<String> keys = new ArrayList<>(data.keySet());
  25.         Collections.sort(keys);
  26.         int index = 0;
  27.         for (String key : keys) {
  28.             String value = data.get(key);
  29.             content.append((index == 0 ? "" : "&")).append(key).append("=").append(value);
  30.             index++;
  31.         }
  32.         return content.toString();
  33.     }
  34.  
  35.     /**
  36.      * 参数加密
  37.      *
  38.      * @param data
  39.      * @return
  40.      * @throws Exception
  41.      */
  42.     public static String getSignature(Map<String, String> data) throws Exception {
  43.         // 对排序好的字符串进行加密，然后转大写
  44.         String summary = DigestUtils.md5Hex(getSortedContent(data)).toLowerCase();
  45.         log.info("md5 summary:" + summary);
  46.         // 对summary进行私钥加密
  47.         return URLEncoder.encode(SecurityUtil.EncryptByRSAPriKey(summary, SecurityUtil.getPrivateKey()), "utf-8");
  48.     }
  49.  
  50.     /**
  51.      * 验证签名
  52.      *
  53.      * @param params
  54.      * @return
  55.      */
  56.     public static boolean verifySign(Map<String, String> params, String sign, String signType) throws UnsupportedEncodingException {
  57.         if (StringUtil.isEmpty(URLDecoder.decode(sign, "utf-8"))) {
  58.             return false;
  59.         }
  60.         //暂不支持非RSA的签名
  61.         if (StringUtil.isEmpty(signType) || !"RSA".equals(signType)) {
  62.             return false;
  63.         }
  64.         //参与签名的数据
  65.         String data = getSortedContent(params);
  66.         log.info("sign data:" + data);
  67.         String summary = DigestUtils.md5Hex(data).toLowerCase();
  68.         log.info("sign summary:" + summary);
  69.  
  70.         String summaryDecode = null;
  71.         try {
  72.             summaryDecode = SecurityUtil.DecryptByRSAPubKey(URLDecoder.decode(sign, "utf-8"), SecurityUtil.getPublicKey());
  73.         } catch (Exception e) {
  74.             throw new RuntimeException("do_digest_error", e);
  75.         }
  76.         return summary.equals(summaryDecode);
  77.     }
  78.  
  79.     public static void main(String[] args) throws Exception {
  80.         Map<String,String> data = new HashMap<>();
  81.         data.put("name","yushanma");
  82.         data.put("age","20");
  83.         String sign = getSignature(data);
  84.         log.info("参数签名：{}",sign);
  85.         String signType = "RSA";
  86.         log.info("验证结果：{}",verifySign(data,sign,signType));
  87.     }
  88. }

测试：

  1. 21:07:33.131 [main] INFO com.commons.util.ApiUtil - md5 summary:da034d300b12c71b6480bf232d09fe34
  2. 21:07:34.964 [main] INFO com.commons.util.ApiUtil - 参数签名：E8tHAwV736SJi9OU8U86%2FBJHGbJxMBgUgOkR5%2BdARtW1MO4WtcosLv97vRWKuslpfrV1AD9%2FxOD4Jm65zczUXZIjzWFcGGI8S9NODHteAC7D7EUj9Szb0%2FA%2Bn0OZac1ev0dtXCY27FGr5MpFSziLJGkAxyhG56MxmwBpsimm9o3BuQrfaaT6CYj2JNqeDZj4Aqk9HkqtCxaS5GIAx9vud6wVxzIDBBUEWzjBbh%2FxAuUIQl8AjcNC6W8yfh1%2FKli98Ghc4hesrrRXT3t6OlXkJSfb56i0n9I19ulbld0SC96RL9CI0B%2Bvc8FIkq9s272v07M9Q6u%2F1LTgSFqj01819Q%3D%3D
  3. 21:07:34.972 [main] INFO com.commons.util.ApiUtil - sign data:age=20&name=yushanma
  4. 21:07:34.973 [main] INFO com.commons.util.ApiUtil - sign summary:da034d300b12c71b6480bf232d09fe34
  5. 21:07:35.119 [main] INFO com.commons.util.ApiUtil - 验证结果：true

控制器签名接口与校验接口：

  1. package com.sign.controller;
  2.  
  3. import com.sign.util.ApiUtil;
  4. import org.springframework.web.bind.annotation.GetMapping;
  5. import org.springframework.web.bind.annotation.RequestParam;
  6. import org.springframework.web.bind.annotation.RestController;
  7.  
  8. import javax.servlet.http.HttpServletRequest;
  9. import java.io.UnsupportedEncodingException;
  10. import java.util.HashMap;
  11. import java.util.Map;
  12.  
  13. @RestController
  14. public class SignController {
  15.  
  16.     /**
  17.      * 模拟前端参数签名
  18.      * @param data
  19.      * @return
  20.      * @throws Exception
  21.      */
  22.     @GetMapping("/sign/getSign")
  23.     public Map<String, Object> getSign(@RequestParam Map<String, String> data) throws Exception {
  24.         // 返回信息
  25.         Map<String, Object> result = new HashMap<>();
  26.         result.put("code", 0);// 状态码
  27.         result.put("msg", "success");// 信息
  28.         String sign = ApiUtil.getSignature(data);
  29.         result.put("data", sign);// 数据
  30.         result.put("verify",ApiUtil.verifySign(data,sign,"RSA"));
  31.         return result;
  32.     }
  33.  
  34.     /**
  35.      * 模拟后端校验签名
  36.      * @param request
  37.      * @param data
  38.      * @return
  39.      * @throws UnsupportedEncodingException
  40.      */
  41.     @GetMapping("/sign/verifySign")
  42.     public boolean verifySign(HttpServletRequest request, @RequestParam Map<String, String> data) throws UnsupportedEncodingException {
  43.         String sign = request.getHeader("sign");
  44.         String signType = request.getHeader("sign_type");
  45.         return ApiUtil.verifySign(data, sign, signType);
  46.     }
  47.  
  48. }

yml相关配置：

  1. server:
  2.   port: 8011
  3. spring:
  4.   application:
  5.     name: service-sign-center
  6.   cloud:
  7.     nacos:
  8.       discovery:
  9.         server-addr: localhost:8848
  10.     sentinel:
  11.       transport:
  12.         port: 9999
  13.         dashboard: localhost:8080

模拟前端签名测试：

模拟后端签名校验测试：

这里我将sign放到header中，是因为签名signature中有些字符是特殊字符，放到parameter中可能会导致有些字符被过滤，最终在校验签名时抛出签名长度不够的错误，这个问题可以通过url编码解决：

  1. java中URL 的编码和解码函数 ：
  2. java.net.URLEncoder.encode(String s)和java.net.URLDecoder.decode(String s);
  3.  
  4. 在javascript 中URL 的编码和解码函数 ：
  5. escape(String s)和unescape(String s);
  6.  
  7. 编码的格式为：%加字符的ASCII码，即一个百分号%，后面跟对应字符的ASCII（16进制）码值。例如 空格的编码值是"%20"。

当参数被修改时，签名验证就会返回false：

至此，通过signature签名机制，我们可以保证请求参数不会被修改，但这不能保证接口不被重复调用，因此还需要token、timestamp来辅助。

加入token防止表单重复提交

模拟重复提交表单

测试控制器

模拟高并发测试接口：

  1. import lombok.extern.slf4j.Slf4j;
  2. import org.springframework.web.bind.annotation.PostMapping;
  3. import org.springframework.web.bind.annotation.RequestParam;
  4. import org.springframework.web.bind.annotation.RestController;
  5. import java.util.HashMap;
  6. import java.util.Map;
  7.  
  8. @Slf4j
  9. @RestController
  10. public class TestController {
  11.  
  12.     /**
  13.      * 模拟高并发重复提交
  14.      * @param data
  15.      * @return
  16.      */
  17.     @PostMapping("/form/repeatSubmitTest")
  18.     public Map<String, Object> repeatSubmitTest(@RequestParam Map<String, String> data) {
  19.         // 模拟提交表单信息
  20.         Map<String, Object> result = new HashMap<>();
  21.         result.put("code", 0);// 状态码
  22.         result.put("msg", "success");// 信息
  23.         log.info("提交表单[]");
  24.         return result;
  25.     }
  26. }

jmeter测试组

开200个线程请求测试接口：

运行测试

表单被重复提交：

解决表单重复提交思路

前端在提交表单之前，先调用后端接口获取临时全局唯一的token，将token存入header，最后才提交表单。

后端生成token时，将token暂时缓存在redis中，设置一个有效期。当后端收到表单提交的请求时，先判断header的 token 是否在缓存中：如果在，则继续处理业务逻辑，并且处理完业务后，删除缓存中的 token；如果不在，说明无效或者重复提交。

加入依赖

redis依赖：

  1. <!--        redis 依赖-->
  2. <!-- https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-data-redis -->
  3. <dependency>
  4.     <groupId>org.springframework.boot</groupId>
  5.     <artifactId>spring-boot-starter-data-redis</artifactId>
  6.     <exclusions>
  7.         <exclusion>
  8.             <groupId>io.lettuce</groupId>
  9.             <artifactId>lettuce-core</artifactId>
  10.         </exclusion>
  11.     </exclusions>
  12. </dependency>
  13. <dependency>
  14.     <groupId>redis.clients</groupId>
  15.     <artifactId>jedis</artifactId>
  16. </dependency>

封装的 Redis 操作类

  1. package com.sign.util;
  2.  
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.data.redis.core.StringRedisTemplate;
  5. import org.springframework.stereotype.Component;
  6.  
  7. import java.util.concurrent.TimeUnit;
  8.  
  9. @Component
  10. public class RedisTemplateUtil {
  11.  
  12.     @Autowired
  13.     private StringRedisTemplate stringRedisTemplate;
  14.  
  15.     /**
  16.      * 设置 String 对象
  17.      * @param key
  18.      * @param data
  19.      * @param timeout
  20.      * @return
  21.      */
  22.     public Boolean setString(String key, Object data, Long timeout) {
  23.         if (data instanceof String) {
  24.             if (null != timeout) {
  25.                 stringRedisTemplate.opsForValue().set(key, (String) data, timeout, TimeUnit.SECONDS);
  26.             } else {
  27.                 stringRedisTemplate.opsForValue().set(key, (String) data);
  28.             }
  29.             return true;
  30.         } else {
  31.             return false;
  32.         }
  33.     }
  34.  
  35.     /**
  36.      * 获取 String 对象
  37.      * @param key
  38.      * @return
  39.      */
  40.     public Object getString(String key) {
  41.         return stringRedisTemplate.opsForValue().get(key);
  42.     }
  43.  
  44.     /**
  45.      * 删除某个 key
  46.      * @param key
  47.      */
  48.     public void delKey(String key) {
  49.         stringRedisTemplate.delete(key);
  50.     }
  51.  
  52. }

token 工具类

  1. package com.sign.util;
  2.  
  3.  
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.stereotype.Component;
  6. import org.springframework.util.StringUtils;
  7.  
  8. import java.util.Objects;
  9. import java.util.UUID;
  10.  
  11.  
  12. @Component
  13. public class TokenUtil {
  14.  
  15.     @Autowired
  16.     private RedisTemplateUtil redisTemplateUtil;
  17.  
  18.     // 时间为 秒L ，如 30分钟 应为 60*30L ，这里设置 1分钟
  19.     private static final Long TIMEOUT = 60L;
  20.  
  21.     /**
  22.      * 生成 token
  23.      * @return
  24.      */
  25.     public String getToken() {
  26.         StringBuilder token = new StringBuilder("token_");
  27.         token.append(UUID.randomUUID().toString().replaceAll("-", ""));
  28.         redisTemplateUtil.setString(token.toString(), token.toString(), TIMEOUT);
  29.         return token.toString();
  30.     }
  31.  
  32.     /**
  33.      * 判断是否有 token
  34.      * @param tokenKey
  35.      * @return
  36.      */
  37.     public Boolean findToken(String tokenKey) {
  38.         if (Objects.nonNull(redisTemplateUtil.getString(tokenKey))) {
  39.             String token = redisTemplateUtil.getString(tokenKey).toString();
  40.             return !StringUtils.isEmpty(token);
  41.         }
  42.         return false;
  43.     }
  44.  
  45.     /**
  46.      * 删除某个 key
  47.      * @param key
  48.      */
  49.     public void deleteKey(String key) {
  50.         redisTemplateUtil.delKey(key);
  51.     }
  52.  
  53. }

测试控制器

获取token接口、模拟业务接口：

  1. package com.sign.controller;
  2.  
  3. import com.sign.util.TokenUtil;
  4. import lombok.extern.slf4j.Slf4j;
  5. import org.springframework.beans.factory.annotation.Autowired;
  6. import org.springframework.util.StringUtils;
  7. import org.springframework.web.bind.annotation.GetMapping;
  8. import org.springframework.web.bind.annotation.PostMapping;
  9. import org.springframework.web.bind.annotation.RequestParam;
  10. import org.springframework.web.bind.annotation.RestController;
  11.  
  12. import javax.servlet.http.HttpServletRequest;
  13. import java.util.HashMap;
  14. import java.util.Map;
  15.  
  16. @Slf4j
  17. @RestController
  18. public class tokenController {
  19.  
  20.     @Autowired
  21.     private TokenUtil tokenUtil;
  22.  
  23.     /**
  24.      * 获取 token
  25.      * @return
  26.      */
  27.     @GetMapping("/getToken")
  28.     public String getToken(){
  29.         return tokenUtil.getToken();
  30.     }
  31.  
  32.     /**
  33.      * 模拟高并发重复提交，根据 token 缓存防止重复提交
  34.      * @param data
  35.      * @return
  36.      */
  37.     @PostMapping("/form/repeatSubmitTest")
  38.     public Map<String, Object> repeatSubmitTest(HttpServletRequest request, @RequestParam Map<String, String> data) {
  39.         // 返回信息
  40.         Map<String, Object> result = new HashMap<>();
  41.         // 检查 header 中的 token
  42.         String token = request.getHeader("token");
  43.         if(!StringUtils.isEmpty(token)) {
  44.             if (tokenUtil.findToken(token)) {
  45.                 // 模拟提交表单信息
  46.                 // TODO Something
  47.                 result.put("code", 0);// 状态码
  48.                 result.put("msg", "success");// 信息
  49.                 log.info("提交表单[]");
  50.                 // 删除缓存中的token
  51.                 tokenUtil.deleteKey(token);
  52.             } else {
  53.                 log.info("请勿重复提交[]");
  54.                 result.put("code", -1);// 状态码
  55.                 result.put("msg", "fail");// 信息
  56.             }
  57.         }else{
  58.             log.info("表单无token[]");
  59.             result.put("code", -1);// 状态码
  60.             result.put("msg", "fail");// 信息
  61.         }
  62.         return result;
  63.     }
  64. }

测试

header无token时：业务逻辑不会执行

header带token请求：阻断重复请求

正常一次请求：正常完成业务逻辑

使用注解与aop拦截实现

无论是参数签名校验还是表单token校验，以上的代码都显得太臃肿，因此采用注解与aop拦截的方式来实现参数校验和token校验，复用代码的同时，让程序变得简洁与高效。

参数签名校验

封装请求常量类

  1. package com.sign.constant;
  2.  
  3. /**
  4.  * 请求参数常量
  5.  */
  6. public class ReqParameterConstant {
  7.     // 头部
  8.     public static final String HEAD = "head";
  9.  
  10.     // 表单
  11.     public static final String FORM = "form";
  12. }

自定义签名校验注解

  1. package com.sign.annotation;
  2.  
  3. import java.lang.annotation.ElementType;
  4. import java.lang.annotation.Retention;
  5. import java.lang.annotation.RetentionPolicy;
  6. import java.lang.annotation.Target;
  7.  
  8. /**
  9.  * 验证参数签名
  10.  */
  11. @Target(value = ElementType.METHOD)
  12. @Retention(RetentionPolicy.RUNTIME)
  13. public @interface VerifySign {
  14.     String type();
  15. }

aop拦截器

  1. package com.sign.component;
  2.  
  3. import com.sign.annotation.VerifySign;
  4. import com.sign.constant.ReqParameterConstant;
  5. import com.sign.util.ApiUtil;
  6. import lombok.extern.slf4j.Slf4j;
  7. import org.apache.commons.lang.StringUtils;
  8. import org.aspectj.lang.ProceedingJoinPoint;
  9. import org.aspectj.lang.annotation.Around;
  10. import org.aspectj.lang.annotation.Aspect;
  11. import org.aspectj.lang.annotation.Pointcut;
  12. import org.aspectj.lang.reflect.MethodSignature;
  13. import org.springframework.beans.factory.annotation.Autowired;
  14. import org.springframework.stereotype.Component;
  15. import org.springframework.web.context.request.RequestContextHolder;
  16. import org.springframework.web.context.request.ServletRequestAttributes;
  17.  
  18. import javax.servlet.http.HttpServletRequest;
  19. import javax.servlet.http.HttpServletResponse;
  20. import java.io.PrintWriter;
  21. import java.util.Enumeration;
  22. import java.util.HashMap;
  23. import java.util.Map;
  24.  
  25. /**
  26.  * 先定义一个切面，myPointCut，这个切面主要针对 controller 层的方法。
  27.  * 环绕通知：aroundAOP，主要用于判断签名是否有效。
  28.  */
  29. @Slf4j
  30. @Aspect
  31. @Component
  32. public class VerifySignAop {
  33.  
  34.     @Autowired
  35.     private ApiUtil apiUtil;
  36.  
  37.     /**
  38.      * 定义切入面：使用 AOP 环绕通知拦截所有访问，拦截的是 controller 层
  39.      */
  40.     @Pointcut("execution(public * com.sign.controller.*.*(..))")
  41.     public void myPointCut() {
  42.  
  43.     }
  44.  
  45.     /**
  46.      * 环绕通知，主要用于验证签名的方法上
  47.      *
  48.      * @param joinPoint
  49.      * @return
  50.      * @throws Throwable
  51.      */
  52.     @Around("myPointCut()")
  53.     public Object aroundAOP(ProceedingJoinPoint joinPoint) throws Throwable {
  54.  
  55.         // 判断方法上是否有注解 @VerifySign
  56.         MethodSignature methodSignature = (MethodSignature) joinPoint.getSignature();
  57.         VerifySign verifySign = methodSignature.getMethod().getDeclaredAnnotation(VerifySign.class);
  58.         String sign = null;
  59.         String signType = null;
  60.         // 如果方法上有此注解，则拦截
  61.         if (null != verifySign) {
  62.  
  63.             // 获取上下文的请求
  64.             HttpServletRequest request = getRequest();
  65.             String type = verifySign.type();
  66.             log.info("type[] " + type);
  67.             if (type.equals(ReqParameterConstant.HEAD)) {
  68.                 sign = request.getHeader("sign");
  69.                 signType = request.getHeader("sign_type");
  70.             } else if (type.equals(ReqParameterConstant.FORM)) {
  71.                 sign = request.getParameter("sign");
  72.                 signType = request.getParameter("sign_type");
  73.             }
  74.             if (StringUtils.isBlank(sign)) {
  75.                 response("该请求无签名！");
  76.                 return null;
  77.             }
  78.             if (StringUtils.isBlank(signType) || !"RSA".equals(signType)) {
  79.                 response("无签名加密方式或签名加密方式不支持！");
  80.                 return null;
  81.             }
  82.             log.info("sign[] " + sign);
  83.             // 获取请求的所有参数
  84.             Map<String, String> data = new HashMap();
  85.             Enumeration<String> parameterNames = request.getParameterNames();
  86.             while (parameterNames.hasMoreElements()) {
  87.                 String key = parameterNames.nextElement();
  88.                 data.put(key, request.getParameter(key));
  89.             }
  90.             boolean verifyFlag = apiUtil.verifySign(data, sign, signType);
  91.             if (!verifyFlag) {
  92.                 response("无效的签名！");
  93.                 return null;
  94.             } else {
  95.                 log.info("有效的签名。");
  96.             }
  97.         }
  98.  
  99.         // 继续往后执行
  100.         Object proceed = joinPoint.proceed();
  101.         return proceed;
  102.     }
  103.  
  104.     /**
  105.      * 获取容器上下文请求
  106.      *
  107.      * @return
  108.      */
  109.     public HttpServletRequest getRequest() {
  110.         ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
  111.         HttpServletRequest request = attributes.getRequest();
  112.         return request;
  113.     }
  114.  
  115.     /**
  116.      * 相应错误响应信息
  117.      *
  118.      * @param msg
  119.      */
  120.     private void response(String msg) {
  121.         ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
  122.         HttpServletResponse response = attributes.getResponse();
  123.         response.setHeader("Content-type", "text/html;charset=UTF-8");
  124.         try (PrintWriter writer = response.getWriter()) {
  125.             writer.println(msg);
  126.         } catch (Exception e) {
  127.             e.printStackTrace();
  128.         }
  129.     }
  130.  
  131. }

控制器的业务方法添加签名校验注解

  1.     @VerifySign(type = ReqParameterConstant.HEAD)
  2.     @GetMapping("sign/test")
  3.     public String test(@RequestParam Map<String,String> data){
  4.         // 模拟业务逻辑
  5.         // TODO Something
  6.         return "test";
  7.     }

测试

参数没有被修改时：签名有效

参数被修改时：签名无效

token校验

自定义注解

  1. package com.sign.annotation;
  2.  
  3. import java.lang.annotation.ElementType;
  4. import java.lang.annotation.Retention;
  5. import java.lang.annotation.RetentionPolicy;
  6. import java.lang.annotation.Target;
  7.  
  8. /**
  9.  * 检查表单 token 是否在缓存中
  10.  */
  11. @Target(value = ElementType.METHOD)// 表示此注解用在方法上
  12. @Retention(RetentionPolicy.RUNTIME)// 注解不仅被保存到class文件中，jvm加载class文件之后，仍然存在
  13. public @interface ExistsApiToken {
  14.     String type();
  15. }

aop拦截器

  1. package com.sign.component;
  2.  
  3. import com.sign.annotation.ExistsApiToken;
  4. import com.sign.constant.ReqParameterConstant;
  5. import com.sign.util.TokenUtil;
  6. import lombok.Synchronized;
  7. import lombok.extern.slf4j.Slf4j;
  8. import org.apache.commons.lang.StringUtils;
  9. import org.aspectj.lang.JoinPoint;
  10. import org.aspectj.lang.ProceedingJoinPoint;
  11. import org.aspectj.lang.annotation.Around;
  12. import org.aspectj.lang.annotation.Aspect;
  13. import org.aspectj.lang.annotation.Before;
  14. import org.aspectj.lang.annotation.Pointcut;
  15. import org.aspectj.lang.reflect.MethodSignature;
  16. import org.springframework.beans.factory.annotation.Autowired;
  17. import org.springframework.stereotype.Component;
  18. import org.springframework.web.context.request.RequestContextHolder;
  19. import org.springframework.web.context.request.ServletRequestAttributes;
  20.  
  21. import javax.servlet.http.HttpServletRequest;
  22. import javax.servlet.http.HttpServletResponse;
  23. import java.io.PrintWriter;
  24.  
  25.  
  26. /**
  27.  * 先定义一个切面，myPointCut，这个切面主要针对 controller 层的方法。
  28.  * <p>
  29.  * 前置通知：before，主要用于获取 token。
  30.  * <p>
  31.  * 环绕通知：aroundAOP，主要用于判断 token 是否重复。
  32.  */
  33. @Aspect
  34. @Component
  35. @Slf4j
  36. public class ExtApiAop {
  37.  
  38.     @Autowired
  39.     private TokenUtil tokenUtil;
  40.  
  41.     /**
  42.      * 定义切入面：使用 AOP 环绕通知拦截所有访问，拦截的是 controller 层
  43.      */
  44.     @Pointcut("execution(public * com.sign.controller.*.*(..))")
  45.     public void myPointCut() {
  46.  
  47.     }
  48.  
  49.     /**
  50.      * 环绕通知，主要用于业务逻辑的方法上
  51.      *
  52.      * @param joinPoint
  53.      * @return
  54.      * @throws Throwable
  55.      */
  56.     @Around("myPointCut()")
  57.     @Synchronized
  58.     public Object aroundAOP(ProceedingJoinPoint joinPoint) throws Throwable {
  59.  
  60.         // 判断方法上是否有注解 @ExistsApiToken
  61.         MethodSignature methodSignature = (MethodSignature) joinPoint.getSignature();
  62.         ExistsApiToken extApiToken = methodSignature.getMethod().getDeclaredAnnotation(ExistsApiToken.class);
  63.         String token = null;
  64.  
  65.         // 如果方法上有此注解，则拦截
  66.         if (null != extApiToken) {
  67.  
  68.             // 获取上下文的请求
  69.             HttpServletRequest request = getRequest();
  70.             String type = extApiToken.type();
  71.             log.info("type[] " + type);
  72.             if (type.equals(ReqParameterConstant.HEAD)) {
  73.                 token = request.getHeader("token");
  74.             } else if (type.equals(ReqParameterConstant.FORM)) {
  75.                 token = request.getParameter("token");
  76.             }
  77.             if (StringUtils.isBlank(token)) {
  78.                 response("请求失效，请勿重复提交！");
  79.                 return null;
  80.             }
  81.             log.info("token[] " + token);
  82.             // 判断缓存里是否有该 token
  83.             Boolean existsFlag = tokenUtil.findToken(token);
  84.             log.info("existsFlag[] " + existsFlag);
  85.             if (!existsFlag) {
  86.                 response("请求失效,请勿重复提交！");
  87.                 log.info("请求失效,请勿重复提交！");
  88.                 return null;
  89.             } else {
  90.                 // 删除 token
  91.                 tokenUtil.deleteKey(token);
  92.                 log.info("请求有效，删除token[]");
  93.             }
  94.         }
  95.  
  96.         // 继续往后执行
  97.         Object proceed = joinPoint.proceed();
  98.         return proceed;
  99.     }
  100.  
  101.     /**
  102.      * 获取容器上下文请求
  103.      *
  104.      * @return
  105.      */
  106.     public HttpServletRequest getRequest() {
  107.         ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
  108.         HttpServletRequest request = attributes.getRequest();
  109.         return request;
  110.     }
  111.  
  112.     /**
  113.      * 相应错误响应信息
  114.      *
  115.      * @param msg
  116.      */
  117.     private void response(String msg) {
  118.         ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
  119.         HttpServletResponse response = attributes.getResponse();
  120.         response.setHeader("Content-type", "text/html;charset=UTF-8");
  121.         try (PrintWriter writer = response.getWriter()) {
  122.             writer.println(msg);
  123.         } catch (Exception e) {
  124.             e.printStackTrace();
  125.         }
  126.     }
  127.  
  128. }

控制器添加token校验注解

  1.    /**
  2.      * 模拟高并发重复提交，根据 token 缓存防止重复提交
  3.      * 添加自定义 @ExistsApiToken 注解通过 aop 切面进行表单 token 认证
  4.      * type 类型为 head ，token 存储在 header 中
  5.      * @param data
  6.      * @return
  7.      */
  8.     @ExistsApiToken(type = ReqParameterConstant.HEAD)
  9.     @PostMapping("/form/repeatSubmitTest")
  10.     public Map<String, Object> repeatSubmitTest(@RequestParam Map<String, String> data) {
  11.         Map<String, Object> result = new HashMap<>();
  12.  
  13.         // 模拟提交表单信息
  14.         // TODO Something
  15.  
  16.         result.put("code", 0);
  17.         result.put("msg", "success");
  18.  
  19.         return result;
  20.     }

测试

模拟前端获取token：

header加入表单token：

高并发测试：

可以看到，有效提交次数为1，重复提交的表单被拦截。

线程安全问题

aop切面的环绕通知方法中使用了@Synchronized注解：同步锁（将action封装原子操作），解决线程安全问题。因为在环绕通知中，有校验token是否在缓存和删除token缓存的操作，如果线程不安全，则会导致token被删除之前，接口被多次调用，业务逻辑被多次执行，不能防止表单重复提交。线程不安全的情况如下图所示：

可以看到，有效提交次数大于1。

同时使用这两个注解

模拟业务接口

  1.     @ExistsApiToken(type = ReqParameterConstant.HEAD)
  2.     @VerifySign(type = ReqParameterConstant.HEAD)
  3.     @GetMapping("/test")
  4.     public String test(@RequestParam Map<String,String> data){
  5.         // 模拟业务逻辑
  6.         // TODO Something
  7.         return "test";
  8.     }

正常情况测试

运行正常：

重复提交测试

重复的请求失效：

修改参数

签名失效：

至此，我们可以保证请求的参数不会被修改，而且该请求只能有效提交一次。

时间戳超时机制

防止表单重复提交还可以采用时间戳超时机制：每次请求加上客户端当前的时间戳，后端接收请求时，与服务端当前时间戳做对比，若不超过3s则认为该请求有效，否则返回服务超时。这种机制还可以有效防御爬取数据，如果有人劫持URL进行DOS攻击和爬取数据，那么他最多只能使用3s。

考虑到客户端与服务端的时钟有微小的差异导致时间戳校验出错，我们采取的对齐方式是客户端第一次连接服务端时请求一个接口获取服务端的当前时间A1，再和客户端的当前时间B1做一个差异化计算（A1-B1=AB），得出差异值AB，客户端再后面的请求中都是传B1+AB给到服务端。

模拟时间戳超时机制

  1. package com.sign.controller;
  2.  
  3. import lombok.extern.slf4j.Slf4j;
  4. import org.springframework.web.bind.annotation.GetMapping;
  5. import org.springframework.web.bind.annotation.RequestParam;
  6. import org.springframework.web.bind.annotation.RestController;
  7.  
  8. import java.time.LocalDateTime;
  9. import java.time.ZoneOffset;
  10. import java.util.HashMap;
  11. import java.util.Map;
  12.  
  13. /**
  14.  * @Author: 马建生
  15.  * @Date: 2021/07/02/10:20
  16.  * @Description: 模拟时间戳超时机制，防御表单重复提交和数据爬取。
  17.  * 使用的时区都是东8区（北京时间），这是为了防止服务器设置时区错误时导致时间不对。
  18.  */
  19. @RestController
  20. @Slf4j
  21. public class TimestampController {
  22.  
  23.     /**
  24.      * 模拟前端获取客户端当前时间，与服务端获取的时间做差异对齐，最后返回对齐后的值
  25.      * 为了模拟真实情况中时钟可能不一致，这里做一个微小的时钟差异
  26.      * 时间戳采用毫秒级别，客户端时间为A，服务端时间为B，差异为 A - B = AB
  27.      * 每次请求附带的时间戳为 A - AB
  28.      *
  29.      * @return
  30.      */
  31.     @GetMapping("/getClientTimestamp")
  32.     public Long getClientTimestamp() {
  33.         // 获取客户端的时间戳
  34.         // 获取秒数，比当前时间快一分钟
  35. //        Long second = LocalDateTime.now().plusMinutes(1).toEpochSecond(ZoneOffset.of("+8"));
  36. //        log.info("timestamp_second[] " + second);
  37.         // 获取毫秒数，慢一分钟
  38.         Long milliSecond = LocalDateTime.now().minusMinutes(1).toInstant(ZoneOffset.of("+8")).toEpochMilli();
  39.         log.info("timestamp_milliSecond[] " + milliSecond);
  40.  
  41.         // 模拟差异比较，客户端时间为A，服务端时间为B，差异为 A - B = AB
  42.         Long difference = milliSecond - getServerTimestamp();
  43.  
  44.         // 模拟时钟对齐，每次请求附带的应为该时间戳
  45.         return milliSecond - difference;
  46.     }
  47.  
  48.     /**
  49.      * 模拟前端获取服务器当前时间
  50.      *
  51.      * @return
  52.      */
  53.     @GetMapping("/getServerTimestamp")
  54.     public Long getServerTimestamp() {
  55.         // 获取秒数
  56.         Long second = LocalDateTime.now().toEpochSecond(ZoneOffset.of("+8"));
  57.         log.info("timestamp_second[] " + second);
  58.         // 获取毫秒数
  59.         Long milliSecond = LocalDateTime.now().toInstant(ZoneOffset.of("+8")).toEpochMilli();
  60.         log.info("timestamp_milliSecond[] " + milliSecond);
  61.         return milliSecond;
  62.     }
  63.  
  64.     /**
  65.      * 模拟业务逻辑，先检查时间戳差异是否在可控范围，若通过则执行业务逻辑，否则返回超时信息
  66.      * 为了方便，这里模拟超时 10s
  67.      * @param data
  68.      * @return
  69.      */
  70.     @GetMapping("/test")
  71.     public Map<String, Object> test(@RequestParam Map<String, String> data) {
  72.  
  73.         // 获取参数中的时间戳
  74.         Long timestamp = Long.parseLong(data.get("timestamp"));
  75.  
  76.         // 返回信息
  77.         Map<String,Object> result = new HashMap<>();
  78.         if (getServerTimestamp() - timestamp <= 10000 && getServerTimestamp() - timestamp >= 0) {
  79.             // 模拟业务逻辑
  80.             // TODO Something
  81.             result.put("code",0);
  82.             result.put("msg","success");
  83.         }else{
  84.             result.put("code",-1);
  85.             result.put("msg","请求超时，请重新提交！");
  86.         }
  87.  
  88.         return result;
  89.     }
  90. }
  91.

测试

对齐时钟

带时间戳请求

超时请求

以注解结合aop方式实现

自定义注解：

  1. package com.sign.annotation;
  2.  
  3. import java.lang.annotation.ElementType;
  4. import java.lang.annotation.Retention;
  5. import java.lang.annotation.RetentionPolicy;
  6. import java.lang.annotation.Target;
  7.  
  8. /**
  9.  * @Author: 马建生
  10.  * @Date: 2021/07/02/11:19
  11.  * @Description: 检查请求的时间戳是否超时
  12.  */
  13.  
  14. @Target(value = ElementType.METHOD)
  15. @Retention(RetentionPolicy.RUNTIME)
  16. public @interface CheckTimestamp {
  17.     String type();
  18. }

aop拦截器：

  1. package com.sign.component;
  2.  
  3. import com.sign.annotation.CheckTimestamp;
  4. import com.sign.constant.ReqParameterConstant;
  5. import lombok.Synchronized;
  6. import lombok.extern.slf4j.Slf4j;
  7. import org.aspectj.lang.ProceedingJoinPoint;
  8. import org.aspectj.lang.annotation.Around;
  9. import org.aspectj.lang.annotation.Aspect;
  10. import org.aspectj.lang.annotation.Pointcut;
  11. import org.aspectj.lang.reflect.MethodSignature;
  12. import org.springframework.stereotype.Component;
  13. import org.springframework.web.context.request.RequestContextHolder;
  14. import org.springframework.web.context.request.ServletRequestAttributes;
  15.  
  16. import javax.servlet.http.HttpServletRequest;
  17. import javax.servlet.http.HttpServletResponse;
  18. import java.io.PrintWriter;
  19. import java.time.LocalDateTime;
  20. import java.time.ZoneOffset;
  21.  
  22. /**
  23.  * @Author: 马建生
  24.  * @Date: 2021/07/02/11:21
  25.  * @Description: 
  26.  * 先定义一个切面，myPointCut，这个切面主要针对 controller 层的方法。
  27.  * 环绕通知：aroundAOP，主要用于判断 token 是否重复。
  28.  * 
  29.  */
  30. @Aspect
  31. @Component
  32. @Slf4j
  33. public class CheckTimestampAop {
  34.     
  35.     /**
  36.      * 定义切入面：使用 AOP 环绕通知拦截所有访问，拦截的是 controller 层
  37.      */
  38.     @Pointcut("execution(public * com.sign.controller.*.*(..))")
  39.     public void myPointCut() {
  40.  
  41.     }
  42.  
  43.  
  44.     /**
  45.      * 环绕通知，主要用于业务逻辑的方法上
  46.      *
  47.      * @param joinPoint
  48.      * @return
  49.      * @throws Throwable
  50.      */
  51.     @Around("myPointCut()")
  52.     @Synchronized
  53.     public Object aroundAOP(ProceedingJoinPoint joinPoint) throws Throwable {
  54.  
  55.         // 判断方法上是否有注解 @CheckTimestamp
  56.         MethodSignature methodSignature = (MethodSignature) joinPoint.getSignature();
  57.         CheckTimestamp extApiToken = methodSignature.getMethod().getDeclaredAnnotation(CheckTimestamp.class);
  58.         long timestamp = 0;
  59.  
  60.         // 如果方法上有此注解，则拦截
  61.         if (null != extApiToken) {
  62.  
  63.             // 获取上下文的请求
  64.             HttpServletRequest request = getRequest();
  65.             String type = extApiToken.type();
  66.             log.info("type[] " + type);
  67.             if (type.equals(ReqParameterConstant.HEAD)) {
  68.                 timestamp = Long.parseLong(request.getHeader("timestamp"));
  69.             } else if (type.equals(ReqParameterConstant.FORM)) {
  70.                 timestamp = Long.parseLong(request.getParameter("timestamp"));
  71.             }
  72.             if (timestamp == 0) {
  73.                 response("请求无效，请重新提交！");
  74.                 return null;
  75.             }
  76.             long serverTimestamp = LocalDateTime.now().toInstant(ZoneOffset.of("+8")).toEpochMilli();
  77.             // 判断超时
  78.             if (serverTimestamp - timestamp <= 10000 && serverTimestamp - timestamp >= 0) {
  79.                 log.info("请求有效。");
  80.             } else {
  81.                 response("请求超时,请重新提交！");
  82.                 return null;
  83.             }
  84.         }
  85.  
  86.         // 继续往后执行
  87.         Object proceed = joinPoint.proceed();
  88.         return proceed;
  89.     }
  90.  
  91.     /**
  92.      * 获取容器上下文请求
  93.      *
  94.      * @return
  95.      */
  96.     public HttpServletRequest getRequest() {
  97.         ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
  98.         HttpServletRequest request = attributes.getRequest();
  99.         return request;
  100.     }
  101.  
  102.     /**
  103.      * 相应错误响应信息
  104.      *
  105.      * @param msg
  106.      */
  107.     private void response(String msg) {
  108.         ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
  109.         HttpServletResponse response = attributes.getResponse();
  110.         response.setHeader("Content-type", "text/html;charset=UTF-8");
  111.         try (PrintWriter writer = response.getWriter()) {
  112.             writer.println(msg);
  113.         } catch (Exception e) {
  114.             e.printStackTrace();
  115.         }
  116.     }
  117. }
  118.

控制器的业务方法上添加注解：

  1.     /**
  2.      * 模拟业务逻辑，先检查时间戳差异是否在可控范围，若通过则执行业务逻辑，否则返回超时信息
  3.      * 为了方便，这里模拟超时 10s
  4.      *
  5.      * @param data
  6.      * @return
  7.      */
  8.     @CheckTimestamp(type = ReqParameterConstant.FORM)
  9.     @GetMapping("/timestamp/test")
  10.     public Map<String, Object> test(@RequestParam Map<String, String> data) {
  11.  
  12.         Map<String, Object> result = new HashMap<>();
  13.  
  14.         // 模拟业务逻辑
  15.         // TODO Something
  16.         result.put("code", 0);
  17.         result.put("msg", "success");
  18.  
  19.         return result;
  20.     }

测试：

带时间戳请求：

超时请求：

token与多端登录

实现思路

因为用户可以在多端登录（手机app，小程序，网页），所以一个用户可能有多个有效token。当用户修改登录密码时需要把全部的token删除，我们将username与list<token>作为键值对缓存在redis中，修改密码时会把username对应的token列表中的全部token删除。

将 token与username以键值对缓存在redis中，并设置失效时间。服务端接收到请求后进行token验证，如果token不存在，说明请求无效。

在oauth模块完成认证后，将token缓存到redis；在gateway网关模块拦截所有请求检查token是否在redis中；也可以在oauth模块checktoken过程中进行检查（可参考Spring Cloud OAuth2 资源服务器CheckToken 源码解析）。

实现细节

修改oauth2模块的控制器

生成token之后将token与username缓存到redis：应将redis操作封装为util，这里为方便未作封装

  1. package com.oauth2.controller;
  2.  
  3.  
  4. import cn.hutool.core.collection.CollUtil;
  5. import cn.hutool.core.convert.Convert;
  6. import com.oauth2.api.CommonResult;
  7. import com.oauth2.constant.RedisConstant;
  8. import com.oauth2.domain.dto.Oauth2TokenDto;
  9. import lombok.extern.slf4j.Slf4j;
  10. import org.springframework.beans.factory.annotation.Autowired;
  11. import org.springframework.data.redis.core.RedisTemplate;
  12. import org.springframework.security.oauth2.common.OAuth2AccessToken;
  13. import org.springframework.security.oauth2.provider.endpoint.TokenEndpoint;
  14. import org.springframework.web.HttpRequestMethodNotSupportedException;
  15. import org.springframework.web.bind.annotation.*;
  16.  
  17. import javax.annotation.Resource;
  18. import java.security.Principal;
  19. import java.util.List;
  20. import java.util.Map;
  21. import java.util.concurrent.TimeUnit;
  22.  
  23. @Slf4j
  24. @RestController
  25. public class AuthController {
  26.  
  27.     @Autowired
  28.     private TokenEndpoint tokenEndpoint;
  29.  
  30.     @Resource
  31.     private RedisTemplate<String, Object> redisTemplate;
  32.  
  33.     /**
  34.      * Oauth2登录认证
  35.      */
  36.     @PostMapping("/oauth/token")
  37.     public CommonResult<Oauth2TokenDto> postAccessToken(Principal principal, @RequestParam Map<String, String> parameters) throws HttpRequestMethodNotSupportedException {
  38.         OAuth2AccessToken oAuth2AccessToken = tokenEndpoint.postAccessToken(principal, parameters).getBody();
  39.         Oauth2TokenDto oauth2TokenDto = Oauth2TokenDto.builder()
  40.                 .token(oAuth2AccessToken.getValue())
  41.                 .refreshToken(oAuth2AccessToken.getRefreshToken().getValue())
  42.                 .expiresIn(oAuth2AccessToken.getExpiresIn())
  43.                 .tokenHead("Bearer ").build();
  44.         String username = parameters.get("username");
  45.         String token = oauth2TokenDto.getToken();
  46.         // 将 token => username 作为键值对存入redis缓存，并设定有效时间为24小时
  47.         // 生产环境时可以将 token 有效期设置长一点，以免 redis 数据频繁变动
  48.         redisTemplate.opsForValue().set(token, username, 3600 * 24, TimeUnit.SECONDS);
  49.         // 判断用户是否首次登录
  50.         if (!redisTemplate.opsForHash().hasKey(RedisConstant.USERID_TOKEN_MAP, username)) {
  51.             log.info("user log[] 首次登录");
  52.             // 将 username 与 list<token> 作为键值对缓存在 redis 中
  53.             redisTemplate.opsForHash().put(RedisConstant.USERID_TOKEN_MAP, username, CollUtil.toList(token));
  54.         }else{
  55.             // 先将之前的 token 拿出来
  56.             Object object = redisTemplate.opsForHash().get(RedisConstant.USERID_TOKEN_MAP, username);
  57.             List<String> userToken = Convert.toList(String.class, object);
  58.             log.info("user log[] 非首次登录 tokenList => {}",userToken.toString());
  59.             // 删除已有的 token
  60.             redisTemplate.opsForHash().delete(RedisConstant.USERID_TOKEN_MAP,username);
  61.             // 添加新增的 token
  62.             userToken.add(token);
  63.             // 将 username 与 list<token> 作为键值对缓存在 redis 中
  64.             redisTemplate.opsForHash().put(RedisConstant.USERID_TOKEN_MAP, username, userToken);
  65.         }
  66.         return CommonResult.success(oauth2TokenDto);
  67.     }
  68. }

修改gateway模块的AuthGlobalFilter

在网关拦截请求对token进行检查，如果不在redis缓存中，则返回401：

  1. package com.gateway.filter;
  2.  
  3. import cn.hutool.core.util.StrUtil;
  4. import com.alibaba.fastjson.JSONObject;
  5. import com.nimbusds.jose.JWSObject;
  6. import lombok.extern.slf4j.Slf4j;
  7. import org.slf4j.LoggerFactory;
  8. import org.springframework.cloud.gateway.filter.GatewayFilterChain;
  9. import org.springframework.cloud.gateway.filter.GlobalFilter;
  10. import org.springframework.core.Ordered;
  11. import org.springframework.core.io.buffer.DataBuffer;
  12. import org.springframework.data.redis.core.RedisTemplate;
  13. import org.springframework.http.HttpStatus;
  14. import org.springframework.http.server.reactive.ServerHttpRequest;
  15. import org.springframework.http.server.reactive.ServerHttpResponse;
  16. import org.springframework.stereotype.Component;
  17. import org.springframework.web.server.ServerWebExchange;
  18. import reactor.core.publisher.Flux;
  19. import reactor.core.publisher.Mono;
  20.  
  21. import javax.annotation.Resource;
  22. import java.nio.charset.StandardCharsets;
  23. import java.text.ParseException;
  24. //import java.util.logging.Logger;
  25.  
  26. @Slf4j
  27. @Component
  28. public class AuthGlobalFilter implements GlobalFilter, Ordered {
  29.  
  30. //    private static Logger LOGGER = (Logger) LoggerFactory.getLogger(AuthGlobalFilter.class);
  31.  
  32.     @Resource
  33.     private RedisTemplate<String, Object> redisTemplate;
  34.  
  35.     @Override
  36.     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
  37.         String token = exchange.getRequest().getHeaders().getFirst("Authorization");
  38.         if (StrUtil.isEmpty(token)) {
  39.             return chain.filter(exchange);
  40.         }
  41.         try {
  42.             // 从token中解析用户信息并设置到Header中去
  43.             String realToken = token.replace("Bearer ", "");
  44.             // 检查token是否在redis缓存中
  45.             Object object = redisTemplate.opsForValue().get(realToken);
  46.             if (object != null) {
  47.                 JWSObject jwsObject = JWSObject.parse(realToken);
  48.                 String userStr = jwsObject.getPayload().toString();
  49.                 log.info("AuthGlobalFilter.filter() user:{}", userStr);
  50. //            LOGGER.info(String.format("AuthGlobalFilter.filter() user:{0}",userStr));
  51.                 // 将json格式的用户信息转成json对象
  52.                 JSONObject user = JSONObject.parseObject(userStr);
  53.                 // 将用户名加到header中，控制器通过HttpServletRequest的getHeader方法获取username
  54.                 ServerHttpRequest request = exchange.getRequest().mutate().header("username", user.getString("user_name")).build();
  55.                 exchange = exchange.mutate().request(request).build();
  56.             } else {
  57.                 // 设置status和body
  58.                 ServerWebExchange finalExchange = exchange;
  59.                 return Mono.defer(() -> {
  60.                     finalExchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);//设置status
  61.                     final ServerHttpResponse response = finalExchange.getResponse();
  62.                     // token无效，返回401，这里可以用json对象实现
  63.                     byte[] bytes = "{\"code\":\"401\",\"data\":\"Access Denied\",\"message\":\"暂未登录或token已经过期\"}".getBytes(StandardCharsets.UTF_8);
  64.                     DataBuffer buffer = finalExchange.getResponse().bufferFactory().wrap(bytes);
  65.                     log.info("token不在redis缓存中，请求无效");
  66.                     return response.writeWith(Flux.just(buffer));//设置body
  67.                 });
  68.             }
  69.         } catch (ParseException e) {
  70.             e.printStackTrace();
  71.         }
  72.         return chain.filter(exchange);
  73.     }
  74.  
  75.     @Override
  76.     public int getOrder() {
  77.         return 0;
  78.     }
  79. }

student模块 修改密码changePassword 接口

  1. /**
  2.  * 修改密码接口
  3.  * 需要旧密码 oldPwd 验证，旧密码通过则更新新密码 newPwd 到数据库
  4.  * 撤销 redis 缓存该用户的所有有效 token
  5.  *
  6.  * @param request
  7.  * @param oldPwd
  8.  * @param newPwd
  9.  * @return
  10.  */
  11. @ApiOperation(
  12.         value = "更新学生账号密码",
  13.         notes = "需要在旧密码的校验，新密码二次校验需在前端完成"
  14. )
  15. @GlobalTransactional
  16. @GetMapping("/changePassword")
  17. public Map<String, Object> changePassword(HttpServletRequest request, @RequestParam("oldPwd") String oldPwd, @RequestParam("newPwd") String newPwd) throws Exception {
  18.  
  19.     // 从 header 获取 username
  20.     String username = request.getHeader("username");
  21.     Student student = new Student();
  22.  
  23.     student.setUsername(username);
  24.     // 先查询该学生信息
  25.     QueryWrapper<Student> studentQueryWrapper = new QueryWrapper<>(student);
  26.     Student studentResult = studentMapper.selectOne(studentQueryWrapper);
  27.  
  28.     log.info("student => {}", studentResult.toString());
  29.     // 返回信息
  30.     Map<String, Object> result = new HashMap<>();
  31.  
  32.     // 如果旧密码匹配，则更新密码，销毁 redis 中该 user 所有有效的 token
  33.     // 第一个参数为明文，第二个参数为密文
  34.     if (passwordEncoder.matches(oldPwd, studentResult.getPassword())) {
  35.         student.setId(studentResult.getId());
  36.         // 密码需要加密
  37.         student.setPassword(passwordEncoder.encode(newPwd));
  38.  
  39.         // 通过 id 更新
  40.         if (studentMapper.updateById(student) == 0) {
  41.             throw new Exception(MySQLMessageConstant.UPDATE_FAIL);
  42.         }
  43.  
  44.         // 销毁所有有效 token
  45.         Object object = redisTemplate.opsForHash().get(RedisConstant.USERID_TOKEN_MAP, username);
  46.         List<String> userToken = Convert.toList(String.class, object);
  47.         redisTemplate.opsForHash().delete(RedisConstant.USERID_TOKEN_MAP, username);
  48.         userToken.forEach(p -> redisTemplate.delete(p));
  49.         result.put("code", 0);// 状态码
  50.         result.put("msg", "success");// 信息
  51.     } else {
  52.         result.put("code", -1);// 状态码
  53.         result.put("msg", "旧密码错误！");// 信息
  54.     }
  55.     return result;
  56. }
  57.

测试

获取token：

  1. {
  2.     "code": 200,
  3.     "message": "操作成功",
  4.     "data": {
  5.         "token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiIxODAxNTYxNTI5QHFxLmNvbSIsInNjb3BlIjpbImFsbCJdLCJpZCI6MTQwNzYxNzg3ODI3MDM4MjA4MSwiZXhwIjoxNjI1NDY3Mjc0LCJhdXRob3JpdGllcyI6WyJTVFVERU5UIl0sImp0aSI6ImE1N2M4MDM4LTI1OTgtNGE4Yi04M2ViLTc3YWRhMDUyYzYwNSIsImNsaWVudF9pZCI6ImNsaWVudC1hcHAifQ.MKN-BgekPMu-DhmGE6F9sUxCtQWxMY7hDHBNUeHkAGfU7NO3xzWZKoyC5pLbxnO8njhSJ57UTNTPuM-kxx-lrjmu542wAqgBQTTEQHTruxR_sGbVLrqRqV0JkJf24JV2NhWgVoIvpNNgB9cOPaUdBxJ52lictfKRFjxei9bcLDH22GwkHBqzNJHnoJIUgms0vS59WwZl5eamkHWwik7RjhySje7dg4PpzaQfSO0n-Q1rfJShioEQdECsELHSKujK6mzZpPvKUpEhYXdlZjwt9jUcS5pHNeCe9CVc2RpKmDGdl6YnX-oh-jvjF2KfVqnRIqUo_fYeDxAPEGWc5YaD5A",
  6.         "refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiIxODAxNTYxNTI5QHFxLmNvbSIsInNjb3BlIjpbImFsbCJdLCJhdGkiOiJhNTdjODAzOC0yNTk4LTRhOGItODNlYi03N2FkYTA1MmM2MDUiLCJpZCI6MTQwNzYxNzg3ODI3MDM4MjA4MSwiZXhwIjoxNjI1NTUwMDc0LCJhdXRob3JpdGllcyI6WyJTVFVERU5UIl0sImp0aSI6IjYwNDFhYzgwLTE5YzAtNDA2MC05YWM2LTRmMTg5ZWE4N2MwZiIsImNsaWVudF9pZCI6ImNsaWVudC1hcHAifQ.E69t1dajlW3DQ0JcEbL1-n--AshAOJ0NTLe5ZZaT1LXEPgG2ENm0gztlHVAwHcK5fvl7Fx5OlaxbkKXoO4oeT0ppokXr8r6mFeNzrmBgvy6Is2PElNekkSkMG0c4pb7Syidg6vmP2MTMcwQ2hudUz0HJ6Bm0nTCkCtpxEMN9aVDVp2QOZsNQdIbqivysF3ZArEC0JghQy2Wk_e8NbB70jQaBbgXDzB2c2VqMQDLYNT8BTXTa4LEb6j8KMtGO_eWtsPxAPBPwtPrzbVvEED1Wa2ZnR9w4kOs5OCMtR_2LemtJuHBRgVxsbHeChmw55E7AOpStDTWhoVtfAx3W0J4-8A",
  7.         "tokenHead": "Bearer ",
  8.         "expiresIn": 3599
  9.     }
  10. }
  11.

访问信息接口：

  1. {
  2.     "msg": "success",
  3.     "code": 0,
  4.     "data": {
  5.         "openid": null,
  6.         "roles": null,
  7.         "updateTime": null,
  8.         "sid": 11819,
  9.         "password": null,
  10.         "regTime": null,
  11.         "loginTime": "2021-07-05T05:41:14",
  12.         "major": null,
  13.         "sno": "pG1kj6V9zeu6GFcosJ2sEg==",
  14.         "nickname": "sam",
  15.         "id": 1407617878270382081,
  16.         "status": true,
  17.         "username": "1801561529@qq.com"
  18.     }
  19. }
  20.

修改token缓存的ttl，使其快速过期：

token过期时重新请求：

模拟多端登录：多次请求登录接口

可以看到redis缓存中，用户有多个有效token。

修改密码测试：

输入错误的旧密码则无法修改。

旧密码正确则修改成功。

redis 清空了该用户所有的token，用户需重新登录。

使用 rsa-encrypt-body-spring-boot

正如该包所描述：Spring Boot 接口请求参数自动加解密。

引入该依赖

  1. <!-- https://mvnrepository.com/artifact/cn.shuibo/rsa-encrypt-body-spring-boot -->
  2. <dependency>
  3.     <groupId>cn.shuibo</groupId>
  4.     <artifactId>rsa-encrypt-body-spring-boot</artifactId>
  5.     <version>1.0.1.RELEASE</version>
  6. </dependency>

 启动类 Application中 添加 @EnableSecurity 注解

  1. package com.sign;
  2.  
  3. import cn.shuibo.annotation.EnableSecurity;
  4. import org.springframework.boot.SpringApplication;
  5. import org.springframework.cloud.client.SpringCloudApplication;
  6.  
  7. @EnableSecurity
  8. @SpringCloudApplication
  9. public class SignApplication {
  10.  
  11.     public static void main(String[] args) {
  12.         SpringApplication.run(SignApplication.class);
  13.     }
  14. }

在application.yml或者application.properties中添加RSA公钥及私钥

  1. 生成的公钥：
  2. MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCoewDlVLsRQoYulINY2Szh89jWA0J7KB2RPdcMKWpX1WCPcw3wB8q/7bBrJFYr2899V59QcJpd7LRf6hEjLmjaz+7QzDhWFz2x11kqROmy0+PWt+SiSlRkGGWmfQGwUF8waAB/fzaQ5V0naDDF48XbAcvAR7DKOnYBcwpRhEHd3wIDAQAB
  3. 生成的私钥：
  4. MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKh7AOVUuxFChi6Ug1jZLOHz2NYDQnsoHZE91wwpalfVYI9zDfAHyr/tsGskVivbz31Xn1Bwml3stF/qESMuaNrP7tDMOFYXPbHXWSpE6bLT49a35KJKVGQYZaZ9AbBQXzBoAH9/NpDlXSdoMMXjxdsBy8BHsMo6dgFzClGEQd3fAgMBAAECgYAXH8LQtx9x0AKgtAuPD0fEv3Y8cXgXdTsRqz4v0iNhaMz3A2CfWEJws0vqeLNHE8VXu8YHAV1+lLVxEKxHeuAzJjJlekGSTZAkfgF4Xm5mdfGuhVRF4ldHHbguQ5oT+OhdsxC3mMAUIwSjAkhuqEU/tK3quZeKt4Z/V3s2qa4fiQJBAPjtQSjHmnhEHayIaIiyWm/Nu+d3plq3tZsu1Mz8yj4oTPQ/rt4MvcMbI2G/tSXh1fzWmleQDlc1sATP27lzdn0CQQCtRJDX+gJejoJ9PMf/0Nzrqr1LH64UaBL0MrFc58vGN0UHtMkwKC1g58R5x006b3m8pp1mUNKutR9tMB/80SiLAkEArqECzTD6VNS0XI11iDBW8YhLAh8WPR4T8UHxV70fxGtRUSg77NrTZURsle5/jovYKwACVttgtB2d1kJbysYNoQJAZ/coYi+llE82hScfaqRMqyv8AUO1FJGOLfDs864yW3F2fjVAMyEoeWkYP2oTMOkKxuPCtk3w3NvZS48A4pYuGQJALU19SKEWk+JGC8tIOdO/tE2rSp/Uc+S/trbOkmSD0vA8sCetJ4jth68eNf60csGXDF2s4fZnc/8vyhkyX51gtg==
  1. server:
  2.   port: 8011
  3. spring:
  4.   redis:
  5.     host: localhost
  6.     port: 6379
  7.     database: 0
  8.   application:
  9.     name: service-sign-center
  10.   cloud:
  11.     nacos:
  12.       discovery:
  13.         server-addr: localhost:8848
  14.     sentinel:
  15.       transport:
  16.         port: 9999
  17.         dashboard: localhost:8080
  18.  
  19. # api 加密
  20. rsa:
  21.   encrypt:
  22.     open: true # 是否开启加密 true  or  false
  23.     showLog: true # 是否打印加解密log true  or  false
  24.     publicKey: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCoewDlVLsRQoYulINY2Szh89jWA0J7KB2RPdcMKWpX1WCPcw3wB8q/7bBrJFYr2899V59QcJpd7LRf6hEjLmjaz+7QzDhWFz2x11kqROmy0+PWt+SiSlRkGGWmfQGwUF8waAB/fzaQ5V0naDDF48XbAcvAR7DKOnYBcwpRhEHd3wIDAQAB
  25.     privateKey: MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKh7AOVUuxFChi6Ug1jZLOHz2NYDQnsoHZE91wwpalfVYI9zDfAHyr/tsGskVivbz31Xn1Bwml3stF/qESMuaNrP7tDMOFYXPbHXWSpE6bLT49a35KJKVGQYZaZ9AbBQXzBoAH9/NpDlXSdoMMXjxdsBy8BHsMo6dgFzClGEQd3fAgMBAAECgYAXH8LQtx9x0AKgtAuPD0fEv3Y8cXgXdTsRqz4v0iNhaMz3A2CfWEJws0vqeLNHE8VXu8YHAV1+lLVxEKxHeuAzJjJlekGSTZAkfgF4Xm5mdfGuhVRF4ldHHbguQ5oT+OhdsxC3mMAUIwSjAkhuqEU/tK3quZeKt4Z/V3s2qa4fiQJBAPjtQSjHmnhEHayIaIiyWm/Nu+d3plq3tZsu1Mz8yj4oTPQ/rt4MvcMbI2G/tSXh1fzWmleQDlc1sATP27lzdn0CQQCtRJDX+gJejoJ9PMf/0Nzrqr1LH64UaBL0MrFc58vGN0UHtMkwKC1g58R5x006b3m8pp1mUNKutR9tMB/80SiLAkEArqECzTD6VNS0XI11iDBW8YhLAh8WPR4T8UHxV70fxGtRUSg77NrTZURsle5/jovYKwACVttgtB2d1kJbysYNoQJAZ/coYi+llE82hScfaqRMqyv8AUO1FJGOLfDs864yW3F2fjVAMyEoeWkYP2oTMOkKxuPCtk3w3NvZS48A4pYuGQJALU19SKEWk+JGC8tIOdO/tE2rSp/Uc+S/trbOkmSD0vA8sCetJ4jth68eNf60csGXDF2s4fZnc/8vyhkyX51gtg==

参数说明：open 为是否开启加密，showLog 为是否打印加解密日志，publicKey 为 RSA 公钥，privateKey 为 RSA 私钥，公私钥均为程序生成。

对Controller 里面的API方法进行加密

  1. // 使用 @Encrypt 注解进行加密
  2.  
  3. @Encrypt
  4. @GetMapping("/testEncrypt")
  5. public Map<String, Object> testEncrypt() {
  6.     Map<String, Object> result = new HashMap<>();
  7.     result.put("code", 1);
  8.     result.put("msg", "success");
  9.     return result;
  10. }

加密测试

当 open 为 false 时，不开启加密：

当 open 为 true 时，开启加密： 

"EwLkCMZPR+DEenZ4RLipEjEzvk9c4LdA1dAqzFH0TPuwmxvoyyI6+XY+W/V8WVHT349QyAbYpCTgjDZ49ZUCUFxDdSYG0CQWPpL+5QryVzd6G2E8bwiwGJmFq3DRl64BSjGxlKZ+bOEF4m1b3yEGyTNWiUy7VXg1AgEp03O+Yv4="

 控制台信息：

2021-07-10 10:22:37.345  INFO [service-sign-center,e02b9067dec97e30,e02b9067dec97e30,true] 11872 --- [nio-8011-exec-3] c.s.advice.EncryptResponseBodyAdvice     : Pre-encrypted data：{"msg":"success","code":1}，After encryption：EwLkCMZPR+DEenZ4RLipEjEzvk9c4LdA1dAqzFH0TPuwmxvoyyI6+XY+W/V8WVHT349QyAbYpCTgjDZ49ZUCUFxDdSYG0CQWPpL+5QryVzd6G2E8bwiwGJmFq3DRl64BSjGxlKZ+bOEF4m1b3yEGyTNWiUy7VXg1AgEp03O+Yv4=

对传过来的加密参数解密

  1. // 使用 @Decrypt 注解对已加密的参数解密
  2.  
  3. // 其他java端程序可以用注解，如果是vue，请用RSA密钥解密
  4.  
  5. @Decrypt
  6. @GetMapping("/testDecrypt")
  7. public Map<String, Object> testDecrypt(@RequestBody Map<String,Object> data) {
  8.     return data;
  9. }

解密测试

解密成功：

 控制台信息：

2021-07-10 10:36:23.851  INFO [service-sign-center,0763359838ba829a,0763359838ba829a,true] 6516 --- [nio-8011-exec-5] c.shuibo.advice.DecryptHttpInputMessage  : Encrypted data received："EwLkCMZPR+DEenZ4RLipEjEzvk9c4LdA1dAqzFH0TPuwmxvoyyI6+XY+W/V8WVHT349QyAbYpCTgjDZ49ZUCUFxDdSYG0CQWPpL+5QryVzd6G2E8bwiwGJmFq3DRl64BSjGxlKZ+bOEF4m1b3yEGyTNWiUy7VXg1AgEp03O+Yv4=",After decryption：{"msg":"success","code":1}

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/小舞很执着/article/detail/853780
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号