Java—通过sign签名认证实现安全的开放接口API

关注微信公众号：CodingTechWork，一起学习进步。

文章目录

引言

  在开发

Java API

时，有可能需要一些安全认证来保证

API

的安全性。下面，我们通过

timestamp

以及

sign签名认证

来实现基本的安全的开发接口

API

。

API接口

curl{ip}:{port}/demo/test/app -X POST -H "Content-Type:application/json" -d '
{
    "appId":"app01",
    "key01": "value01",
    "key02": "value02,
    "key03": "value03",
    "sign": "77f4d9119d43c41491ab8a7c0530a618d6e0823560eb6dd028f62ae56b1ab7bb",
    "timestamp":165820977
}'

timestamp保证唯一性

通过timestamp校验，保证约定时间内请求的唯一性

shell生成timestamp

1. shell中生成秒级timestamp

echo$(date'+%s')

1. shell中生成毫秒级timestamp

# 通过纳秒除以1000000的方式实现echo $[$(date'+%s%N')/1000000]

java生成timestamp模板

// 得到秒级long currentTimeStamp =System.currentTimeMillis()/1000;

sign签名认证

实现方式

1. app服务端配置对应appSecret, 例如app123456
2. 所有请求参数按照字母排序, 配装字符串, 采用key=value并用&链接
3. 添加签名appSecret, 字符末尾加上appSecret=app123456
4. 采用SHA-256生产签名
5. 例：appId=app01&params=key01=value01;key02=value02;key03=value03&appSecret=app123456

shell生成sha-256值

echo -n "appId=app01&params=key01=value01;key02=value02;key03=value03&appSecret=app123456"| sha256sum |awk'{print $1}'

结果

77f4d9119d43c41491ab8a7c0530a618d6e0823560eb6dd028f62ae56b1ab7bb

java生成sha-256模板

packagecom.demo.testimportjava.io.UnsupportedEncodingException;importjava.security.MessageDigest;importjava.security.NoSuchAlgorithmException;importjava.util.Base64;importorg.apache.commons.lang.StringUtils;importlombok.extern.slf4j.Slf4j;@Slf4jpublicclassEncrypt{/**
     * 返回 SHA-256 串
     *
     * @param strText
     * @return
     */publicstaticStringSHA256(finalString strText){returnSHA(strText,"SHA-256");}/**
     * 返回 SHA-512 串
     *
     * @param strText
     * @return
     */publicstaticStringSHA512(finalString strText){returnSHA(strText,"SHA-512");}publicstaticStringMD5(finalString strText){returnSHA(strText,"MD5");}/**
     * SHA 加密
     *
     * @param strText
     * @return
     */privatestaticStringSHA(finalString strText,finalString type){String ret =null;if(strText !=null&& strText.length()>0){try{MessageDigest messageDigest =MessageDigest.getInstance(type);
                messageDigest.update(strText.getBytes());byte[] buffer = messageDigest.digest();StringBuffer sb =newStringBuffer();for(int i =0; i < buffer.length; i++){String hex =Integer.toHexString(0xff& buffer[i]);if(hex.length()==1){
                        sb.append('0');}
                    sb.append(hex);}
                ret = sb.toString();}catch(NoSuchAlgorithmException e){
                log.error("{} encrypt failed.{}", type, e);}}return ret;}/**
     * 手机号脱敏处理
     *
     * @param phone
     * @return
     */publicstaticStringdesensitizedPhone(String phone){if(StringUtils.isNotEmpty(phone)){
            phone = phone.replaceAll("(\\w{3})\\w*(\\w{4})","$1****$2");}return phone;}/**
     * base64加密
     *
     * @param content
     * @return
     */publicstaticStringbase64Encoder(String content){try{String base64encodedString =Base64.getEncoder().encodeToString(content.getBytes("utf-8"));return base64encodedString;}catch(UnsupportedEncodingException e){
            log.error("base64Encoder failed", e);}returnnull;}/**
     * base64解密
     *
     * @param content
     * @return
     */publicstaticStringbase64Decoder(String content){try{// 解码byte[] base64decodedBytes =Base64.getDecoder().decode(content);returnnewString(base64decodedBytes,"utf-8");}catch(UnsupportedEncodingException e){
            log.error("base64Decoder failed", e);}returnnull;}}