通过时间戳,秘钥,token等实现接口安全性要求,一段不成熟的代码,但愿可以提供一些思路。
@Slf4j
public class UserInfoInterceptor implements HandlerInterceptor {
/**
* 封装,不需要过滤的list列表
*/
protected static List<String> URLS = new ArrayList<String>();
static {
URLS.add("/api/system/getUserInfo");
URLS.add("/api/system/getYearInfo");
}
/**
* 封装,不需要过滤的list列表
*/
protected static List<String> APIURLS = new ArrayList<String>();
static {
APIURLS.add("/api/system/saveUser");
APIURLS.add("/api/system/removeUser");
APIURLS.add("/api/system/saveZtInfo");
APIURLS.add("/api/system/removeZtInfo");
}
@Resource
private RedisUtil redisUtil;
private static final String PRIVATE_KEY = "tbl@52sm";
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws UnsupportedEncodingException {
String url = request.getRequestURI();
String ipAddress = getIpAddress(request);
// 通过ip可以设置ip黑名单进行拦截
//过滤不需要拦截的请求
for (String u : URLS) {
if (StringUtils.contains(url, u)) {
return true;
}
}
// 时间戳
String timestamp = request.getHeader("timestamp");
if (StringUtils.isBlank(timestamp)) {
log.error("timestamp未传");
throw new BizException(ResultCode.HEADER_PARAMS_NOT_UNDELIVERED.getCode(), ResultCode.HEADER_PARAMS_NOT_UNDELIVERED.getDesc());
}
// 签名
String sign = request.getHeader("sign");
if (StringUtils.isBlank(timestamp)) {
log.error("sign未传");
throw new BizException(ResultCode.HEADER_PARAMS_NOT_UNDELIVERED.getCode(), ResultCode.HEADER_PARAMS_NOT_UNDELIVERED.getDesc());
}
//解析签名:时间戳+tbb52sm 双重MD5加密
String newSign = DigestUtils.md5Hex(timestamp + PRIVATE_KEY);
newSign = DigestUtils.md5Hex(newSign);
// 校验签名是否正确
if (!sign.equals(newSign)) {
log.error("非法操作");
throw new BizException(ResultCode.ILLEGAL_OPERATION.getCode(), ResultCode.ILLEGAL_OPERATION.getDesc());
}
// 签名存放在redis中,设定1分钟的有效期
long incr = redisUtil.incr("sign:" + ipAddress + url + sign, 1);
if (incr == 1) {
redisUtil.expire("sign:" + ipAddress + url + sign, 60);
} else {
log.error("非法操作");
throw new BizException(ResultCode.ILLEGAL_OPERATION.getCode(), ResultCode.ILLEGAL_OPERATION.getDesc());
}
// 时间戳相差超过1分钟,认定为非法操作
long interval = System.currentTimeMillis() - Long.valueOf(timestamp);
if (interval > SessionKeyConstants.REQUEST_EXP_TIME) {
log.error("非法操作");
throw new BizException(ResultCode.ILLEGAL_OPERATION.getCode(), ResultCode.ILLEGAL_OPERATION.getDesc());
}
// 对外api请求只需要传递时间戳和签名,此段代码位置不能变动
for (String apiUrl : APIURLS) {
if (StringUtils.contains(url, apiUrl)) {
return true;
}
}
// accessToken
String accessToken = request.getHeader("accessToken");
if (StringUtils.isBlank(accessToken)) {
log.error("access_token未传");
throw new BizException(ResultCode.HEADER_PARAMS_NOT_UNDELIVERED.getCode(), ResultCode.HEADER_PARAMS_NOT_UNDELIVERED.getDesc());
}
// 用户信息
Object operator = redisUtil.get(SessionKeyConstants.ACCESS_TOKEN + accessToken);
if (Objects.isNull(operator)) {
log.error("accessToken过期");
throw new BizException(ResultCode.ACCESS_TOKEN_EXPIRED.getCode(), ResultCode.ACCESS_TOKEN_EXPIRED.getDesc());
} else {
FinancialLoginUserVO userVO = JSON.parseObject(operator.toString(), FinancialLoginUserVO.class);
// 保存用户数据
UserThreadLocal.set(userVO);
}
return true;
}
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
UserThreadLocal.remove();
}
/**
* ip
* @param request
* @return
*/
public static String getIpAddress(HttpServletRequest request) {
String ip = request.getHeader("x-forwarded-for");
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("Proxy-Client-IP");
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("WL-Proxy-Client-IP");
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("HTTP_CLIENT_IP");
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("HTTP_X_FORWARDED_FOR");
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getRemoteAddr();
}
return ip;
}
}