接口添加统一签名，验签，加密，解密RequestBodyAdvice ResponseBodyAdvice

验签 加密

/**
 * @Description 解密、验签、处理requestBody
 * @Author YYJ
 * @Date 2019/7/25
 */
@Slf4j
@ControllerAdvice(basePackages = "cn.com.sgcc.sgec.ksplatform.module.emelt.app.controller")
public class DecryptRequestBodyAdvice implements RequestBodyAdvice {

    @Value("${app.keys.privateKey}")
    private String privateKey;

    @Value("${app.encryption}")
    private boolean encryption;

    @Override
    public boolean supports(MethodParameter methodParameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
        return methodParameter.hasParameterAnnotation(RequestBody.class);
    }

    @Override
    public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage, MethodParameter parameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) throws IOException {
        return new DecryptHttpInputMessage(inputMessage);
    }

    @Override
    public Object afterBodyRead(Object body, HttpInputMessage inputMessage, MethodParameter parameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
        return body;
     }

    @Override
    public Object handleEmptyBody(Object body, HttpInputMessage inputMessage, MethodParameter parameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
        return body;
    }


    private class DecryptHttpInputMessage implements HttpInputMessage {

        private HttpInputMessage inputMessage;

        public DecryptHttpInputMessage(HttpInputMessage inputMessage) {
            this.inputMessage = inputMessage;
        }

        @Override
        public InputStream getBody() throws IOException {
            InputStream input = inputMessage.getBody();

            //FIXME 1.参数解密处理
            String body = IOUtils.toString(input, "UTF-8");
            log.info("请求参数："+body);
            ItemRequest request = JSONUtil.toBean(JSONUtil.parseObj(body), ItemRequest.class);

            //不加密
            if(!encryption){
                return IOUtils.toInputStream(JSONUtil.toJsonStr(request.getRaw()),"UTF-8");
            }

            //FIXME 2.签名验证
            log.debug("raw:{}",request.getRaw());
            log.debug("time:{}",request.getTime().getTime());
            String hashData = request.getRaw().toString()+request.getTime().getTime();
            String hash = SmUtil.sm3(hashData);
            log.debug("sm3 hash:{}",hash);
            if(!request.getHash().equals(hash)){
                log.error("数据签名不一致,您的数据可能被篡改");
                throw new KsException("数据签名不一致,您的数据可能被篡改");
            }

            //FIXME 3.解的对称算法秘钥
            String token = request.getToken();
            RSA rsa = new RSA(privateKey,null);
            String key = rsa.decryptStr(token, KeyType.PrivateKey);
            log.debug("key:{}",key);

            //FIXME 4.解得原文
            SymmetricCrypto sm4 = SmUtil.sm4(key.getBytes());
            String raw = sm4.decryptStr(request.getRaw().toString());
            log.debug("raw:{}",raw);

            return IOUtils.toInputStream(JSONUtil.toJsonStr(raw),"UTF-8");
        }

        @Override
        public HttpHeaders getHeaders() {
            return inputMessage.getHeaders();
        }

    }

ItemRequest 类

/**
 * 统一请求
 * @author mrxia
 *
 */
@Data
@Slf4j
public class ItemRequest implements Serializable{

	/**
	 * 
	 */
	private static final long serialVersionUID = -1441518635151006789L;
	
	/**
	 * 时间
	 */
	private Date time;
	
	/**
	 * 数据体
	 */
	private Object raw;
	
	/**
	 * hash值 用于传输完整性保护
	 */
	private String hash;
	
	/**
	 * 秘钥
	 */
	private String token;
	
	public <E> E toBean(Class<E> clazz){
		try {
			return (E) JSONUtil.toBean(JSONUtil.parseObj(this.getRaw()), clazz);
		} catch (Exception e) {
			log.error("无法转换对象,{},{}",clazz.getSimpleName(),e.getMessage());
		}
		return null;
	}
	
	public Map<String, Object> toMap(){
		return toBean(HashMap.class);
	}
}

统一添加签名

/**
 * @Description 返回结果responseBody加密、签名等统一处理
 * @Author YYJ
 * @Date 2019/7/29
 */
@Slf4j
@ControllerAdvice(basePackages = "cn.com.sgcc.sgec.ksplatform.module.emelt.app.controller")
public class EncryptResponseBodyAdvice implements ResponseBodyAdvice {

    @Value("${app.keys.publicKey}")
    private String publicKey;

    @Value("${app.encryption}")
    private boolean encryption;

    @Override
    public boolean supports(MethodParameter returnType, Class converterType) {
        return true;
    }

    @Override
    public Object beforeBodyWrite(Object body, MethodParameter returnType, MediaType selectedContentType, Class selectedConverterType, ServerHttpRequest request, ServerHttpResponse response) {
        //不加密或者不为标准返回对象
        if(!encryption || !(body instanceof AppItemResponse)){
            return body;
        }

        //FIXME 统一返回加密
        return encodeBody(body);
    }

    private Object encodeBody(Object object){
        AppItemResponse itemResponse = (AppItemResponse) object;
        Object data = itemResponse.getData();

        //FIXME 1.生成16位秘钥加密数据
        String key = RandomUtil.randomString(16);
        String jsonData = null;
        if(data != null){
            jsonData = JSONObject.toJSONString(data);
            log.debug("response jsonData:{}",jsonData);
        }
        SymmetricCrypto sm4 = SmUtil.sm4(key.getBytes());
        String encryptionData = sm4.encryptHex(jsonData);

        //FIXME 2.非对称加密秘钥
        RSA rsa = new RSA(null,publicKey);
        String token = rsa.encryptBase64(key, KeyType.PublicKey);

        //FIXME 3.数据签名
        long time = DateUtil.current(false);
        String hashData = encryptionData+time;
        String hash = SmUtil.sm3(hashData);

        //FIXME 4.包装新的对象
        itemResponse.setHash(hash);
        itemResponse.setTime(time);
        itemResponse.setToken(token);
        itemResponse.setData(encryptionData);
        log.debug("response key:{},hash:{},time:{},token:{},data:{}",key,hash,time,token,encryptionData);
        return itemResponse;
    }
}

AppItemResponse 类

@Data
@EqualsAndHashCode(callSuper = false)
public class AppItemResponse<T> implements Serializable{


	/**
	 * 
	 */
	private static final long serialVersionUID = -5096367565578119351L;

	/**
	 * 时间
	 */
	private long time;
	
	/**
	 * 数据体
	 */
	private T data;
	
	/**
	 * hash值 用于传输完整性保护
	 */
	private String hash;
	
	/**
	 * 秘钥
	 */
	private String token;
	
	/**
	 * 消息
	 */
	private String msg;
	
	/**
	 * 响应状态码
	 */
	private String status;
	
	private AppItemResponse(T data){
		this.time = new Date().getTime();
		this.data = data;
	}
	
	protected AppItemResponse(){
	}
	
	public static <T> AppItemResponse success(T data) {
		AppItemResponse<T> ir = new AppItemResponse<>(data);
		ir.status = ResponseCodeConstant.OK;
		return ir;
	}
	public static <T> AppItemResponse success(String msg, T data) {
		AppItemResponse<T> ir = new AppItemResponse<>(data);
		ir.status = ResponseCodeConstant.OK;
		ir.msg = msg;
		return ir;
	}

	
	public static <T> AppItemResponse fault(String msg) {
		AppItemResponse<T> ir = new AppItemResponse<>();
		ir.setMsg(msg);
		ir.status = ResponseCodeConstant.ERROR;
		return ir;
	}
	
	public static <T> AppItemResponse create(T data, String status) {
		AppItemResponse<T> ir = new AppItemResponse<>(data);
		ir.status = status;
		return ir;
	}
	
	public String toJsonStr(){
		return JSONUtil.toJsonStr(this);
	}

	public boolean success(){
		return StringUtils.equalsIgnoreCase(ResponseCodeConstant.OK,status);
	}

}