HTTP接口安全
HTTP Header 增加字段@ResponseBody
public OfflineQRCodeResp OfflineQRCode(@RequestHeader("Authorization") String token,@RequestHeader("nonce") String nonce,
@RequestHeader("timestamp") String timestamp,
@RequestHeader("signature") String signature,
@RequestBody OfflineQRCodeReq in){
GlobalVars.IncreaseApiCallCount();
OfflineQRCodeResp resp = new OfflineQRCodeResp();
//--------------------- 验证签名 ----------------------
VerifySignatureReturn verifySignatureReturn = nonceService.verifySignature(nonce, timestamp,in.toString(), signature);
if (!verifySignatureReturn.isbSuccess()) {
resp.setCode(201);
resp.setMessage("签名验证失败，" + verifySignatureReturn.getMessage());
resp.setTimestamp(in.getTimestamp());
return resp;
}
验证签名
@Override
public VerifySignatureReturn verifySignature(String nonce, String timestamp, String requestParams, String strClientSignValue) {
VerifySignatureReturn verifySignatureReturn = new VerifySignatureReturn();
boolean ret = false;
if (safe_enable == 0) {
verifySignatureReturn.setbSuccess(true);
return verifySignatureReturn;
}
// ------------- 时间戳 过期时间验证 --------------------
long lngTimeStamp = Long.parseLong(timestamp);
long lngCurTimeStamp = (new Date()).getTime();
long lngOffset = 0;
lngOffset = Math.abs(lngCurTimeStamp - lngTimeStamp);
if (lngOffset > 1000 * safe_expire) {
verifySignatureReturn.setbSuccess(false);
SimpleDateFormat sdf =new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS");
String strTimeString = sdf.format(new Date(Long.parseLong(String.valueOf(lngTimeStamp))));
verifySignatureReturn.setMessage("时间戳过期，差值=" + lngOffset + "，时间戳时间: " + strTimeString);
return verifySignatureReturn;
}
// ---------------- 随机数 验证 ---------------------
if (safe_nonce == 1) {
String cacheNonceString = cacheService.get(nonce);
if (cacheNonceString == null) {
cacheService.put(nonce);
}else {
verifySignatureReturn.setbSuccess(false);
verifySignatureReturn.setMessage("随机数失效");
return verifySignatureReturn;
}
}
// ---------------- 签名验证 ------------------------
String strSignValue = SignatureUitl.getSignature(nonce, timestamp, requestParams);
if (strClientSignValue.equalsIgnoreCase(strSignValue) == false) {
logger.info("签名验证失败，正确的签名: " + strSignValue);
verifySignatureReturn.setbSuccess(false);
verifySignatureReturn.setMessage("signature invalid.");
return verifySignatureReturn;
}
verifySignatureReturn.setbSuccess(true);
return verifySignatureReturn;
}
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！
页:
[1]