领克、吉利车联网app的鉴权逆向记录

包含X-Ca-Signature算法，领克app

import hashlib
import hmac
import base64
import uuid
import time
from urllib.parse import urlparse, parse_qs, urlencode
import requests

def generate_x_ca_signature(
    method: str,
    url: str,
    app_key: str,
    app_secret: str,
    headers: dict = None,
    content_type: str = "application/json"
) -> dict:
    """
    生成包含 X-Ca-Signature 的请求头
    参数:
        method: HTTP方法(GET/POST/PUT/DELETE)
        url: 请求URL(包含查询参数)
        app_key: 应用Key(X-Ca-Key)
        app_secret: 应用密钥(用于HMAC签名)
        headers: 额外请求头(可选)
        content_type: Content-Type值
    返回:
        包含完整签名头的字典
    """
    # 解析URL和查询参数
    parsed_url = urlparse(url)
    path = parsed_url.path
    query_params = parse_qs(parsed_url.query)
    
    # 对查询参数排序并规范化
    canonical_query = urlencode(sorted(query_params.items()), doseq=True)
    signed_url = f"{path}?{canonical_query}" if canonical_query else path

    # 生成必要头信息
    nonce = str(uuid.uuid4())  # 随机数
    timestamp = str(int(time.time() * 1000))  # 当前时间戳(毫秒)
    signature_method = "HmacSHA256"  # 签名方法
    content_md5 = "*/*"  # 内容MD5(默认值)

    # 构造待签名字符串(严格按照顺序用\n拼接)
    string_to_sign = "\n".join([
        method.upper(),
        content_md5,
        "",  # 空行
        content_type,
        "",  # 空行
        f"X-Ca-Key:{app_key}",
        f"X-Ca-Nonce:{nonce}",
        f"X-Ca-Signature-Method:{signature_method}",
        f"X-Ca-Timestamp:{timestamp}",
        signed_url
    ])

    # 计算HMAC-SHA256签名(二进制)
    binary_signature = hmac.new(
        app_secret.encode(),
        string_to_sign.encode(),
        hashlib.sha256
    ).digest()

    # 对签名结果进行Base64编码
    x_ca_signature = base64.b64encode(binary_signature).decode()

    # 构造基础请求头
    base_headers = {
        "token": "bearer55685c40-6873-4fee-9326-5c131335004a",  # 需替换为当前token
        "X-Ca-Key": app_key,
        "X-Ca-Nonce": nonce,
        "X-Ca-Timestamp": timestamp,
        "X-Ca-Signature-Method": signature_method,
        "X-Ca-Signature": x_ca_signature,
        "X-Ca-Signature-Headers": "X-Ca-Key,X-Ca-Timestamp,X-Ca-Nonce,X-Ca-Signature-Method",
        "Content-Type": content_type,
    }
    
    # 合并额外头信息(如果有)
    return {**base_headers, **(headers or {})}

def make_signed_request(
    method: str,
    url: str,
    app_key: str,
    app_secret: str,
    body: dict = None,
    headers: dict = None
):
    """
    发送带签名的API请求
    参数:
        method: HTTP方法
        url: 请求URL
        app_key: 应用Key
        app_secret: 应用密钥
        body: 请求体数据(可选)
        headers: 额外请求头(可选)
    返回:
        requests响应对象
    """
    # 生成签名头
    signed_headers = generate_x_ca_signature(
        method=method,
        url=url,
        app_key=app_key,
        app_secret=app_secret,
        headers=headers
    )
    
    # 发送请求(POST/PUT方法包含body)
    return requests.request(
        method=method,
        url=url,
        headers=signed_headers,
        json=body if method in ("POST", "PUT") else None
    )

if __name__ == "__main__":
    # 配置参数
    APP_KEY = "204644386" 
    APP_SECRET = "QCl7udM3PB9cOIOwquwPglikFQnzJRsX"
    # 测试URL列表
    TEST_URLS = [
        "https://h5-api.lynkco.com/auth/user/info",
        "https://h5-api.lynkco.com/app/v1/task/getShareCode"
        
    ]

    # 遍历测试URL发送请求
    for api_url in TEST_URLS:
        print(f"\n正在测试URL: {api_url}")
        response = make_signed_request(
            method="GET",
            url=api_url,
            app_key=APP_KEY,
            app_secret=APP_SECRET
        )
        print(f"状态码: {response.status_code}")
        print(f"响应内容: {response.text}")