接口安全与限制调用次数

login.php

<?php

$token = generate_access_token($res['username'], $res['password'], 'http://erpserver'); //生成token

// token 存redis 1库

$redis->select(1);
$redis->set($token, $token, 1800);

/**
 * 生成token
 * @param $appID string 应用ID
 * @param $secretKey string  应用私钥
 * @param $appKey int 应用公钥
 * @return string
 */
function generate_access_token($appID, $secretKey, $appKey)
{
	$time = time();
	$sign = sha1($time . $appID . $secretKey);
	$token = base64_encode("{$time},{$appID},{$appKey},{$sign}");
	return $token;
}


/**
 * 解析TOKEN
 * @param $access_token
 * @return array
 */
function getCurrentTokenInfo($access_token)
{
	$token_array = base64_decode($access_token);
	$token_array = explode(',', $token_array); //分割token,分隔符由Token生成算法决定

	$token = [];
	$token['time'] = $token_array[0]; //时间戳
	$token['usersId'] = $token_array[1]; //id
	$token['appKey'] = $token_array[2]; //暴露在外的公钥
	$token['sign'] = $token_array[3]; //签名

	return $token['usersId'];
}

?>



conn.php

<?php

$pdo = new PDO("mysql:host=localhost;dbname=icerp_xhdz", "root", "root"); //公司 mysql连接

// 连接redis
$redis = new Redis();
$redis->connect('127.0.0.1', 6379);

?>



base.php

<?php

include 'conn.php';

// 接受前端header头传入的token
$token = $_SERVER['HTTP_TOKEN'] ?? '';


// 判断token
if ( !isset($token) || empty($token) ) {
    exit(json_encode(['code' => 199, 'msg' => '无效token']));
} 


// 获取token
$redis->select(1);
$token = $redis->get($token);


// token无效，提示用户重新登录
if ( empty($token) ) exit(json_encode(['code' => 203, 'msg' => 'token无效']));


// 限制一分钟可以调用5次接口
$redis->select(2);
$cc = $redis->get($token);
if ($cc) {
    $count = $redis->incr($token);
    if ($count > 5) exit(json_encode(['code' => 199, 'msg' => '频繁访问，请一分钟后再次尝试']));
} else {
    $redis->setex($token, 1800, 1);
}


// 更新user_token 的过期时间 (延期，保证其有效期内连续操作不掉线)
$redis->select(1);
$redis->set($token, $token, 1800);

?>