后端中间件验证
class Safe
{
/**
* 处理请求
*
* @param \think\Request $request
* @param \Closure $next
* @return Response
*/
public function handle($request, \Closure $next)
{
try {
//
# 验证token 、可以直接加在路由后面
# 验证时间戳
$this->checkTime();
# 验证签名
$this->checkSign();
return $next($request);
}catch (Exception $exception) {
return json($exception->getMessage());
}
}
/**
* 验证时间戳
* @throws Exception
*/
public function checkTime(){
$client_time = request()->get('timestamp') ?: request()->post('timestamp');
if (!is_numeric($client_time)) {
throw new Exception('时间戳格式不正确');
}
if (time() - $client_time > 120) {
throw new Exception('请求超时');
}
}
/**
* 检查签名
*/
public function checkSign(){
$client_sign = request()->get('sign') ?: request()->post('sign');
# 判断是否有签名
if (!$client_sign) {
throw new Exception('签名不正确');
}
# 判断签名是否正确
$server_sign = $this->getSign();
if ($client_sign != $server_sign) {
throw new Exception('签名不正确');
}
}
/**
* 获取服务端签名
* @return string
*/
public function getSign(){
# 获取所有请求的参数
$params = request()->all();
# 签名规则
# 第一步 参与签名的参数不包括签名本身、不包括token
unset($params['sign']);
unset($params['token']);
# 第二步 按照ASCII排序
ksort($params);
$wait_sign = '';
foreach ($params as $key=> $value) {
$wait_sign .= $key.'='.$value.'&';
}
# 去除多余的& 符号
$wait_sign = rtrim($wait_sign,'&');
return md5($wait_sign);
}
}
前端生成
<script src="../javaScript-MD5/js/md5.js"></script>
<script>
// # 获取所有请求的参数
// # 签名规则
// # 第一步 参与签名的参数不包括签名本身、不包括token
// # 第二步 按照ASCII排序
// # 去除多余的& 符号
var params = new Array();
params['id'] = 1;
params['name'] = '张三';
var sign = createSign(params);
params['sign'] = sign;
var url = 'http://pyg.com/list?'
for (var i in params) {
url += i + '=' + params[i] + '&';
}
$.ajax({
url:url,
dataType:'json',
success:function (result) {
console.log(result);
}
})
function createSign(params) {
var timestamp = Math.ceil((new Date()).getTime()/1000);
params['timestamp'] = timestamp;
params.sort();
var wait_sign = ''
for (var i in params) {
wait_sign += i + '=' + params[i] + '&';
}
wait_sign = wait_sign.substr(0,wait_sign.length-1);
console.log(wait_sign)
sign = hex_md5(wait_sign)
return sign;
}
</script>
需要下面MD5插件,,因为jquery没有MD5函数;