Web拦截器实现http访问方法和数字签名认证
当有对外系统对接业务的时候，数字签名能很好的校验非法访问，本文提供拦截器实现验证数字签名的方法
1.在项目中把commons-codec-1.3jar放进去以支持MD5加密类
2.在web.xml中添加web拦截器
<filter> <filter-name>signFilter</filter-name> <filter-class>com.wanda.crs.filter.HttpRequestSignInputCheck</filter-class> <init-param> <param-name>excludedPages</param-name> <param-value>/damai/*,/index.jsp,/tableIndex.jsp,/table/*</param-value> </init-param> </filter> <filter-mapping> <filter-name>signFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
3.编写拦截器的执行类HttpRequestSignInputCheck.java
package com.wanda.crs.filter; import java.io.IOException; import java.util.HashMap; import java.util.Map; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.apache.commons.lang.StringUtils; import org.slf4j.Logger; import com.alibaba.fastjson.JSON; import com.wanda.crs.standard.model.ClientInfoModel; import com.wanda.crs.utils.Contants; import com.wanda.crs.utils.HttpClientUtils; import com.wanda.crs.utils.MyRequestUtil; import com.wanda.crs.utils.PropConfigUtil; import com.wanda.crs.utils.RenderHelper; import com.wanda.crs.utils.SignCheck; import com.wanda.crs.utils.StandardResult; import com.wanda.crs.utils.StringUtil; import com.wanda.crs.utils.httpclient.HttpRequest; public class HttpRequestSignInputCheck implements Filter{ private Logger _log = org.slf4j.LoggerFactory.getLogger(getClass()); private static final String requestClientAppId = "clientId"; /** * 是否是开发模式 */ private static final boolean devMode = true; private String excludedPages; //不需要拦截的url private String[] excludedPagesArray; private static String api_url=""; @Override public void destroy() { System.gc(); } @Override public void doFilter(ServletRequest req, ServletResponse resp,FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest)req; HttpServletResponse response = (HttpServletResponse)resp; boolean isExcludedPage = false; if(excludedPagesArray!=null&&excludedPagesArray.length>0){ for (String page : excludedPagesArray) { //不需要拦截的url if(((HttpServletRequest) request).getServletPath().equals(page)){ isExcludedPage = true; break; }else if(page.contains("*")&&((HttpServletRequest) request).getServletPath().startsWith("/"+page.split("/")[1])){ isExcludedPage = true; break; } } } if (isExcludedPage) {//在过滤url之外 chain.doFilter(request, response); }else{ if(!HttpRequest.METHOD_GET.equalsIgnoreCase(request.getMethod()) && !HttpRequest.METHOD_POST.equalsIgnoreCase(request.getMethod())){ StandardResult resultBase = new StandardResult(); StringBuilder errmsg = new StringBuilder(); errmsg.append("禁止[" + request.getMethod() + "]方法访问;允许的方法为["); errmsg.append(HttpRequest.METHOD_GET + "]和["); errmsg.append(HttpRequest.METHOD_POST + "]"); resultBase.setStatus(StandardResult.FAIL); resultBase.setMessage(String.valueOf(errmsg)); RenderHelper.render(resultBase, response); return; } Map<String, String> values = new HashMap<String, String>(); if (HttpRequest.METHOD_GET.equals(request.getMethod())) { values = MyRequestUtil.getParamsMap(request, "UTF-8"); } else { values = MyRequestUtil.getParamsMap(request,null); } String clientId = values.get(requestClientAppId); String channelKey = ""; _log.debug("********HttpRequestSignInputCheck requestParams**********" + values); String queryString = SignCheck.createLinkString(values); _log.info("请求的URL:" + request.getRequestURL().toString() + "?" + queryString); /*******验证渠道合法性********/ if (StringUtils.isBlank(clientId)) { String respMsg = "clientId不能为空"; StandardResult resultBase = new StandardResult(); resultBase.setStatus(StandardResult.FAIL); resultBase.setMessage(respMsg); RenderHelper.render(resultBase, response); return; } Map<String,String> params = new HashMap<String,String>(); params.put("idClient", clientId); StandardResult result = HttpClientUtils.sendHttpMethod(api_url+"/product/getClientInfo", params, Contants.HTTP_METHOD_POST); if (result.getData()!=null&&!"null".equals(String.valueOf(result.getData()))&&StringUtil.isNotEmpty(String.valueOf(result.getData()))) { ClientInfoModel clientInfo = JSON.parseObject(String.valueOf(result.getData()),ClientInfoModel.class); if(clientInfo==null||StringUtil.isEmpty(clientInfo.getClientKey())){ String respMsg = "渠道商查询信息有误，请联系系统管理员！"; StandardResult resultBase = new StandardResult(); resultBase.setStatus(StandardResult.FAIL); resultBase.setMessage(respMsg); RenderHelper.render(resultBase, response); return; } channelKey = clientInfo.getClientKey(); }else{ result.setData(""); result.setCount(0); /*result.setMessage(Contants.MSG_CHANNELID_ERROR); result.setStatus(Contants.STATUS_CHANNELID_ERROR);*/ if(StringUtils.isNotBlank(result.getMessage())){ result.setMessage(result.getMessage()); result.setStatus(result.getStatus()); }else{ result.setMessage(Contants.MSG_CHANNELID_ERROR); result.setStatus(Contants.STATUS_CHANNELID_ERROR); } RenderHelper.render(result, response); return; } if(!devMode){ /**********验证签名**********/ boolean status = SignCheck.getSignVeryfy(values, values.get("sign"),channelKey); if (!status) { StandardResult resultBase = new StandardResult(); resultBase.setStatus(StandardResult.SIGN_ERROR); resultBase.setMessage("签名验证失败"); RenderHelper.render(resultBase, response); return; } } _log.info("**********HttpRequestSignInputCheck finished***************"); chain.doFilter(req,response); } } @Override public void init(FilterConfig filterConfig) throws ServletException { excludedPages = filterConfig.getInitParameter("excludedPages"); if(StringUtils.isNotEmpty(excludedPages)){ excludedPagesArray = excludedPages.split(","); } } static{ api_url = PropConfigUtil.getValueByKey("api.url"); } }
MD5工具类
SignCheck.java
package com.wanda.crs.utils; import java.io.UnsupportedEncodingException; import java.security.SignatureException; import java.util.ArrayList; import java.util.Collections; import java.util.HashMap; import java.util.List; import java.util.Map; import org.apache.commons.codec.digest.DigestUtils; import org.apache.commons.httpclient.NameValuePair; import org.apache.commons.lang.StringUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import com.wanda.crs.utils.httpclient.HttpProtocolHandler; import com.wanda.crs.utils.httpclient.HttpRequest; import com.wanda.crs.utils.httpclient.HttpResponse; import com.wanda.crs.utils.httpclient.HttpResultType; /** * 功能：MD5签名处理核心文件，不需要修改 * 版本：1.0 * 修改日期：2014-09-19 * 说明： * */ public class SignCheck { private static Logger logger = LoggerFactory.getLogger(SignCheck.class); /** * 签名字符串 * @param text 需要签名的字符串 * @param key 密钥 * @param input_charset 编码格式 * @return 签名结果 */ public static String sign(String text, String key, String input_charset) { text = text + key; return DigestUtils.md5Hex(getContentBytes(text, input_charset)); } /** * 签名字符串 * @param text 需要签名的字符串 * @param sign 签名结果 * @param key 密钥 * @param input_charset 编码格式 * @return 签名结果 */ public static boolean verify(String text, String sign, String key, String input_charset) { text = text + key; String mysign = DigestUtils.md5Hex(getContentBytes(text, input_charset)); logger.info("signed: " + mysign); if(mysign.equals(sign)) { return true; } else { return false; } } /** * @param content * @param charset * @return * @throws SignatureException * @throws UnsupportedEncodingException */ private static byte[] getContentBytes(String content, String charset) { if (charset == null || "".equals(charset)) { return content.getBytes(); } try { return content.getBytes(charset); } catch (UnsupportedEncodingException e) { throw new RuntimeException("MD5签名过程中出现错误,指定的编码集不对,您目前指定的编码集是:" + charset); } } /** * 除去数组中的空值和签名参数 * @param sArray 签名参数组 * @return 去掉空值与签名参数后的新签名参数组 */ public static Map<String, String> paraFilter(Map<String, String> sArray) { Map<String, String> result = new HashMap<String, String>(); if (sArray == null || sArray.size() <= 0) { return result; } for (String key : sArray.keySet()) { String value = sArray.get(key); if (value == null || value.equals("") || key.equalsIgnoreCase("sign") || key.equalsIgnoreCase("sign_type")) { continue; } result.put(key, value); } return result; } public static String createLinkString(Map<String, String> params) { List<String> keys = new ArrayList<String>(params.keySet()); Collections.sort(keys); String prestr = ""; for (int i = 0; i < keys.size(); i++) { String key = keys.get(i); String value = params.get(key); if (i == keys.size() - 1) {//拼接时，不包括最后一个&字符 prestr = prestr + key + "=" + value; } else { prestr = prestr + key + "=" + value + "&"; } } return prestr; } public static String sendPostInfo(Map<String, String> sParaTemp, String gateway, String key) throws Exception { // 待请求参数数组 Map<String, String> sPara = buildRequestPara(sParaTemp, key); HttpProtocolHandler httpProtocolHandler = HttpProtocolHandler .getInstance(); HttpRequest request = new HttpRequest(HttpResultType.BYTES); // 设置编码集 request.setCharset("utf-8"); request.setParameters(generatNameValuePair(sPara)); request.setUrl(gateway); HttpResponse response = httpProtocolHandler.execute(request); if (response == null) { return null; } String strResult = response.getStringResult(); return strResult; } public static Map<String, String> buildRequestPara( Map<String, String> sParaTemp, String key) { // 除去数组中的空值和签名参数 Map<String, String> sPara = Core.paraFilter(sParaTemp); // 生成签名字符串 String signString = SignCheck.createLinkString(sPara); String input_charset = sPara.get("_input_charset"); if(StringUtils.isBlank(input_charset)){ input_charset = "utf-8"; } String mysign = SignCheck.sign(signString, key, input_charset); // 签名结果与签名方式加入请求提交参数组中 sPara.put("sign", mysign); // sPara.put("sign_type", "MD5"); return sPara; } /** * MAP类型数组转换成NameValuePair类型 * * @param properties * MAP类型数组 * @return NameValuePair类型数组 */ private static NameValuePair[] generatNameValuePair( Map<String, String> properties) { NameValuePair[] nameValuePair = new NameValuePair[properties.size()]; int i = 0; for (Map.Entry<String, String> entry : properties.entrySet()) { nameValuePair[i++] = new NameValuePair(entry.getKey(), entry.getValue()); } return nameValuePair; } //默认的加密编码 public static String DEFAULT_INPUT_CHARSET = "UTF-8"; /** * 根据传入的信息，生成签名结果 * @param Params 传入的参数数组 * @param sign 比对的签名结果 * @return 生成的签名结果 * @throws Exception */ public static boolean getSignVeryfy(Map<String, String> Params, String sign, String channelKey) { boolean flag = true; //过滤空值、sign与sign_type参数 Map<String, String> sParaNew = paraFilter(Params); //获取待签名字符串 String preSignStr = createLinkString(sParaNew); //获取签名字符集 String input_charset = Params.get("_input_charset"); if (StringUtils.isEmpty(input_charset)) { input_charset = DEFAULT_INPUT_CHARSET; } //获得签名验证结果 boolean isSign = false; logger.info("签名之前字符串:" + preSignStr); isSign = verify(preSignStr, sign, channelKey, input_charset); if (!isSign) { flag = false; } return flag; } /** * 根据传入参数获取签名字符串 * @param params * @return */ public static String getSignByMap(Map<String,String> params,String key){ //过滤空值、sign与sign_type参数 Map<String, String> sParaNew = paraFilter(params); //获取待签名字符串 String text = createLinkString(sParaNew); //获取签名字符集 String input_charset = "UTF-8"; text = text + key; String mysign = DigestUtils.md5Hex(getContentBytes(text, input_charset)); return mysign; } }
937
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
