springboot使用SHA256加密算法对接口访问控制

使用场景

由于业务系统较多，且存在很多个提供给第三方系统的查询接口，第三方系统属于外部系统，个别系统在调用内部系统接口时可能存在安全风险，在周五项目组评审后决定，在对外提供的接口中，请求方需要添加私钥请求校验，我方使用 SHA256 算法计算签名，然后进行Base64 encode，最后再进行urlEncode，来得到最终的签名。周末闲来无事，简单研究一波（基于内网中其他系统已有的类似功能，结合外网资料）。

学习使用

创建一个简单的springboot项目，目录结构如下：

由于并不是对所有接口进行过滤验证，所以决定添加自定义注解用来判定是否需要鉴权：

@Documented
@Inherited
@Target({ElementType.METHOD,ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface Auth {
    boolean validate() default true;//是否需要鉴权
}

需要创建一个controller，假设是对外提供的接口服务：

@Controller
public class TestController {

    @Auth
    @GetMapping("/auth" )
    private String myTest(){
        System.out.println("mystest.....");
        return "ok";
    }
}

因为需要对接口进行过滤拦截，所以需要创建拦截器，通过继承HandlerInterceptorAdapter（待深入学习）实现的过滤拦截：

public class AuthSercurityInterceptor extends HandlerInterceptorAdapter {
    @Value("${auth.secret.info:12345}")
    private String secret;
    @Value("${auth.need:true}")
    private Boolean needAuth;

    //HEADER Authorization
    private static final String INFO_TIME = "timestamp";
    private static final String INFO_SIGN = "sign";
    private static final String AUTH_HEADER = "Authorization";

    public String getSecret() {
        return secret;
    }

    public void setSecret(String secret) {
        this.secret = secret;
    }

    public Boolean getNeedAuth() {
        return needAuth;
    }

    public void setNeedAuth(Boolean needAuth) {
        this.needAuth = needAuth;
    }

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        if (needAuth==null||!needAuth){
            return true;
        }
        if(!handler.getClass().isAssignableFrom(HandlerMethod.class)){
            return true;
        }
        Auth auth = ((HandlerMethod)handler).getMethodAnnotation(Auth.class);
        if (auth==null||!auth.validate()){
            return true;
        }
        String authorization = request.getHeader(AUTH_HEADER);
        System.out.println("authorization is :" + authorization);
        String[] info = authorization.trim().split(",");
        if (info==null||info.length<1){
            throw new Exception("error .....");
        }
        String timestamp = null;
        String sign = null;
        for (int i = 0; i < info.length; i++) {
            String str = info[i].trim();
            if (StringUtils.isEmpty(str)){
                continue;
            }
            String[] strSplit = str.split("=");
            if (strSplit==null||strSplit.length!=2){
                continue;
            }
            String key = strSplit[0];

            String value = strSplit[1];

            if (INFO_TIME.equalsIgnoreCase(key)){
                timestamp = value;
                System.out.println("timestamp is :" + timestamp);
            }
            if (INFO_SIGN.equalsIgnoreCase(key)){
                sign = value;
                System.out.println("sign is :" + sign);
            }
        }
        if (StringUtils.isEmpty(timestamp)||StringUtils.isEmpty(sign)){
            throw new Exception("error timestamp or sign is null");
        }
        String sha256Str = SHAUtils.getSHA256Str(secret,timestamp);
        System.out.println("sha256str is :" + sha256Str);
            if (StringUtils.isEmpty(sha256Str)){
                throw new Exception("sha256Str is null ...");
            }
            if (!sha256Str.equals(sign)){
                throw new Exception("sign error...");
            }
            return super.preHandle(request,response,handler);
        }

}

因为新增了自定义拦截器，所以需要将自定义拦截器进行配置：
AuthConfig.java

@Configuration
public class AuthConfig extends WebMvcConfigurationSupport {
    @Bean    //自定义的AuthSercurityInterceptor 
    public AuthSercurityInterceptor authSercurityInterceptor(){
        return new AuthSercurityInterceptor();
    }

    @Override    //进行注册添加AuthSercurityInterceptor 
    protected void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authSercurityInterceptor()).addPathPatterns("/**");
        super.addInterceptors(registry);
    }
}

SHA256 算法计算签名，然后进行Base64 encode，最后再进行urlEncode，来得到最终的签名：

public class SHAUtils {
    public static final String ENCODE_TYPE_HMAC_SHA_256 ="HmacSHA256";
    public static final String ENCODE_UTF_8_LOWER ="utf-8";
    public static final String ENCODE_UTF_8_UPPER ="UTF-8";

    public static String getSHA256Str(String secret,String message) throws Exception {
        if (StringUtils.isEmpty(secret)){
            return null;
        }
        String encodeStr;
        try{
            //HMAC_SHA256 加密
            Mac HMAC_SHA256 = Mac.getInstance(ENCODE_TYPE_HMAC_SHA_256);
            SecretKeySpec secre_spec = new SecretKeySpec(secret.getBytes(ENCODE_UTF_8_UPPER),ENCODE_TYPE_HMAC_SHA_256);
            HMAC_SHA256.init(secre_spec);
            byte[] bytes = HMAC_SHA256.doFinal(message.getBytes(ENCODE_UTF_8_UPPER));
            if (bytes==null&&bytes.length<1){
                return null;
            }

            //字节转换为16进制字符串
            String SHA256 =byteToHex(bytes);
            if (StringUtils.isEmpty(SHA256)){
                return null;
            }
            //base64
            String BASE64 = Base64.getEncoder().encodeToString(SHA256.getBytes(ENCODE_UTF_8_UPPER));
            if (StringUtils.isEmpty(BASE64)){
                return null;
            }

            //url encode
            encodeStr = URLEncoder.encode(BASE64,ENCODE_UTF_8_LOWER);
        }catch (Exception e){
            throw new Exception("get 256 info error ....");
        }
        return encodeStr;
    }

    private static String byteToHex(byte[] bytes){

        if (bytes==null){
            return null;
        }
        StringBuffer stringBuffer = new StringBuffer();
        String temp=null;
        for (int i = 0; i <bytes.length ; i++) {
            temp = Integer.toHexString(bytes[i]&0xff);
            if (temp.length()==1){
                stringBuffer.append("0");
            }
            stringBuffer.append(temp);
        }
        return stringBuffer.toString();
    }
}

运行程序，在auth.need:true设置为false的时候，接口正常访问和返回，

改为true后，就请求接口的时候就要传递Authorization在请求头中，要包含timestamp和sign，否则会报空指针异常，假如对接系统方目前还不知道具体怎样传参数才能请求到接口，随意在请求头的Authorization加上例如timestamp=1590829472,sign=/auth后去请求，因为秘钥不对，所以无法请求到接口。

authorization is :timestamp=1590829472,sign=/auth
timestamp is :1590829472
sign is :/auth
2020-05-30 17:56:05.632 ERROR 13616 --- [nio-8080-exec-2] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is java.lang.Exception: sign error...] with root cause

java.lang.Exception: sign error...

将最终的sha256str作为签名信息交给经过授权的对接第三方，让他们在请求头Authorization，将新提供的信息添加上timestamp=1590829472,sign=ZGQwNTY0MDNiYzM3OWI5ZmEyMGY2ZDU0ZTk0NzBhMzc5ODgyZDY4OWM2YWJmNzYyNzM2YmZlMzY0ZjMyYmE2Mw%3D%3D，即可成功请求到接口信息。