第三方调用安全校验
1. 拦截器代码
/** * @Description 添加请求是否合法验证拦截器 * @author 田林(lin.tian@mljr.com) * @date 2017年12月1日 下午4:20:38 */ @Component("signature") public class SignatureFilter implements Filter { private Logger logger = LoggerFactory.getLogger(SignatureFilter.class); @Value("${rsaKey}") private String rsaKey; public final static String JSON_PARAMS_TYPE="application/json"; public final static String FORM_PARAMS_TYPE="application/x-www-form-urlencoded"; @Override public void init(FilterConfig filterConfig) throws ServletException { } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { Map<String,String> singleValueMap = Maps.newHashMap(); HttpServletRequest httpRequest=(HttpServletRequest)request; String password = httpRequest.getHeader("password"); // 是否通过验证 boolean flag = false; //时间戳 String timestamp = httpRequest.getHeader("timestamp"); String serverPath = httpRequest.getServletPath(); if("/".equals(serverPath)||serverPath.contains("/fe-che-union/static")){ chain.doFilter(request,response); }else{ HttpServletResponse httpResponse= (HttpServletResponse) response; String contentType = httpRequest.getContentType(); if(!StringUtils.isEmpty(contentType)&&contentType.contains(JSON_PARAMS_TYPE)){//如果是json请求方式 SignatureRequestWrapper requestWrapper = new SignatureRequestWrapper(httpRequest); String body = HttpHelper.getBodyString(requestWrapper); if (StringUtils.isEmpty(body)) { logger.error("非法请求, 无参数"); OutWriterUtil.write(httpResponse, JSONObject.toJSONString(RespDTO.fail("无参数"))); return; } Map<String, Object> parameters = JSONObject.parseObject(body); Set<String> keySet = parameters.keySet(); for(String key:keySet){ singleValueMap.put(key, JSONObject.toJSONString(parameters.get(key))); } request=requestWrapper; }else if(!StringUtils.isEmpty(contentType)&&contentType.contains(FORM_PARAMS_TYPE)){ Map<String,String[]> parameterMap = request.getParameterMap(); for(String key : parameterMap.keySet()){ String[] valueArray = parameterMap.get(key); if(valueArray!=null&&valueArray.length>0){ singleValueMap.put(key, valueArray[0]); } } } else { flag = true; } if(flag){ chain.doFilter(request,response); }else{ // 校验参数合法性 flag = SignatureUtils.checkSign(singleValueMap, rsaKey,password,timestamp); if(flag){ chain.doFilter(request,response); }else{ OutWriterUtil.write(httpResponse, JSONObject.toJSONString(RespDTO.fail("签名错误必须存在"))); return; } } } } private boolean checkSign(Map<String, Object> parameters) { Map<String, String> requestParams=new HashMap<>(); SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); for (String key : parameters.keySet()) { String valueStr=""; Object value = parameters.get(key); if (value ==null){ continue; } if(BeanUtils.isSimpleValueType(value.getClass())){ //如果是简单类型 if(Date.class.isAssignableFrom(value.getClass())){//如果是时间类型 valueStr = dateFormat.format(value); }else{ valueStr=value.toString(); } }else { //如果是复杂类型 valueStr=JSONObject.toJSONString(value); } requestParams.put(key,valueStr); } return SignUtils.checkSign(requestParams,rsaKey); } private boolean checkParamIsExist(Map<String, Object> parameters, String... keys) { for (String key: keys) { if(parameters.get(key)==null){return false;} } return true; } @Override public void destroy() { } }
2. 对输入流进行封装：
public class SignatureRequestWrapper extends HttpServletRequestWrapper { private HttpServletRequest original; private byte[] reqBytes; private boolean firstTime = true; public SignatureRequestWrapper(HttpServletRequest request) { super(request); reqBytes = HttpHelper.getBodyString(request).getBytes(Charset.forName("UTF-8")); } @Override public BufferedReader getReader() throws IOException{ InputStreamReader isr = new InputStreamReader(new ByteArrayInputStream(reqBytes)); return new BufferedReader(isr); } @Override public ServletInputStream getInputStream() throws IOException { ServletInputStream sis = new ServletInputStream() { @Override public boolean isFinished() { return false; } @Override public boolean isReady() { return false; } @Override public void setReadListener(ReadListener readListener) { } private int i; @Override public int read() throws IOException { byte b; if(reqBytes.length > i){ b = reqBytes[i++]; }else{ b = -1; } return b; } }; return sis; } }
3. 校验代码
public class SignUtils { /** * 拼接键值对 * * @param key * @param value * @param isEncode * @return */ private static String buildKeyValue(String key, String value, boolean isEncode) { StringBuilder sb = new StringBuilder(); sb.append(key); sb.append("="); if (isEncode) { try { sb.append(URLEncoder.encode(value, "UTF-8")); } catch (UnsupportedEncodingException e) { sb.append(value); } } else { sb.append(value); } return sb.toString(); } /** * 对支付参数信息进行签名 * * @param map * 待签名授权信息 * * @return */ public static String sign(Map<String, String> map, String rsaKey) { StringBuilder sortStr = getSortStr(map); StringBuilder authInfo = getAuthInfo(rsaKey, sortStr); String sign = EncryptUtil.MD5(authInfo.toString()); return sign; } private static StringBuilder getAuthInfo(String rsaKey, StringBuilder sortStr) { StringBuilder authInfo=new StringBuilder(); authInfo.append(rsaKey); authInfo.append(sortStr); authInfo.append(rsaKey); return authInfo; } private static StringBuilder getSortStr(Map<String, String> map) { List<String> keys = new ArrayList<String>(map.keySet()); // key排序 Collections.sort(keys); StringBuilder authInfo = new StringBuilder(); for (int i = 0; i < keys.size() - 1; i++) { String key = keys.get(i); String value = map.get(key); authInfo.append(buildKeyValue(key, value, false)); authInfo.append("&"); } String tailKey = keys.get(keys.size() - 1); String tailValue = map.get(tailKey); authInfo.append(buildKeyValue(tailKey, tailValue, false)); return authInfo; } /** * 要求外部订单号必须唯一。 * @return */ public static boolean checkSign(Map<String, String> map, String rsaKey) { String password=map.remove("password"); StringBuilder sortStr = getSortStr(map); StringBuilder authInfo = getAuthInfo(rsaKey, sortStr); return EncryptUtil.checkPassWord(authInfo.toString(),password); }
4. Filter 无法直接通过 @Value 注入properties属性 ，可以通过 DelegatingFilterProxy 来处理，将Filter 交给spring来管理。web.xml 配置：
<filter>
<filter-name>signature</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>signature</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
