Android 接口加签的使用

为什么要做接口加签呢，目的就是防止别人恶意估计，就是频繁的调用例如 发短信验证的接口，导致公司产生高昂的短信费用。

那么接口加签就可以解决这个问题了，但是需要客户端和服务端约定好。以下就是加签的过程。

步骤一：服务端给我们一个接口来获取RAS的公钥，或者将服务端的公钥写死在客户端。
这里为了方便说明，我们是将公钥放在本地的。

例如，我们拿到的密钥为：KEY = “kqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDFCVD2j”

然后 通过算法获取对应KEY 的密钥对象 RSAPrivateKey ：

  public static RSAPrivateKey loadPrivateKey(String privateKeyStr) {
        RSAPrivateKey key = null;
        try {
            PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(Base64.decode(privateKeyStr, Base64.DEFAULT));
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            key = (RSAPrivateKey) keyFactory.generatePrivate(pkcs8EncodedKeySpec);
        } catch (NoSuchAlgorithmException e) {
            Logger.e(e);
        } catch (InvalidKeySpecException e) {
            Logger.e(e);
        } catch (NullPointerException e) {
            Logger.e(e);
        }
        return key;
    }

然后将时间戳、应用的一些信息，如版本号、包名等，拼接成字符串 info，然后将 生成的 info作为http请求的 header 的Value， Key 可以和后台约定好，假设为 base-info。

 .addHeader("base-info", info)

如果有请求体，那么需要对类型为json的请求体和上面的info拼接生成字符串 originData

然后再用和后端约定的对称加密算法 对 上面的 originData 进行加密生成 encryData。

然后将 生成的 encryData 作为http请求的 header 的Value ， Key 可以和后台约定好，假设为 signature。

.addHeader("signature", encryData)

服务端 : 服务端通过相同的规则，将info 和 originData 拼接起来作为result，然后利用之前约定对称加密算法 进行验证 result 和 encryData 是否匹配。

下面给出代码：
我这边是通过 给 Retrofit 的 OkHttp设置 inteceptor来实现的：

public class SignInterceptor implements Interceptor {
    private static final String TAG = "SignInterceptor";
    private static final Charset UTF8 = Charset.forName("UTF-8");
    private static final String PKG_NAME = Engine.getInstance().getContext().getPackageName();
    private static final String DEVICE_ID = DeviceUtils.getUUID();
    private static final String IFULI_OS_INFO = "pig|" + AppUtils.getAppVersion(Engine.getInstance().getContext()) + "|" + PKG_NAME + "|" + DEVICE_ID;
    private static final RSAPrivateKey KEY = EncryptUtils.loadPrivateKey("MIIEvQIBAxxx90YCGOPf8CjAZQUQ7Ke+j8DXRoBYjDlhXXETMP/A3tZ26k0X4iW5/BSDw4HGSHQdcD13CeDb3O60rsbZckJGYg1s=");
    private static final RSAPublicKey TEST_KEY = EncryptUtils.loadPublicKey("MIIBIjANBgkqhkiG9w0BAQ3V1oqGj0pOwK2Prpfgx6NcHV7NLynEvh+bU03hLnn73MJc0uD+aaWsawIDAQAB");
    private static final int RSA = 1;
    private static final Pattern PATH_PATTERN = Pattern.compile("/v\\d+/");

    @Override
    public Response intercept(Chain chain) throws IOException {
        return chain.proceed(createSignRequest(chain.request()));
    }

    private Request createSignRequest(Request request) {
        String timestamp = String.valueOf(System.currentTimeMillis());
        String sign = createSign(request, timestamp);
        return request.newBuilder()
                .addHeader("pig-info", IFULI_OS_INFO)
                .addHeader("pig-signature", timestamp + "|" + RSA + "|" + sign)
                .build();
    }

    private String createSign(Request request, String timestamp) {
        StringBuilder signBuilder = new StringBuilder();

        appendSignValue(signBuilder, IFULI_OS_INFO);

        String path = request.url().encodedPath();
        appendSignValue(signBuilder, subPath(path));

        String query = request.url().query();
        appendSignValue(signBuilder, sortQuery(query));

        String body = null;
        RequestBody requestBody = request.body();
        //只对json类型请求加签，否则可能是上传图片啥的
        try {
            if (requestBody != null && requestBody.contentType() != null &&
                    "application".equalsIgnoreCase(requestBody.contentType().type()) &&
                    "json".equalsIgnoreCase(requestBody.contentType().subtype())) {
                Buffer buffer = new Buffer();
                requestBody.writeTo(buffer);
                body = buffer.readString(UTF8);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        appendSignValue(signBuilder, body);

        appendSignValue(signBuilder, timestamp);

        String originalSign = signBuilder.toString();
        String sign = EncryptUtils.signSHA256withRSAPrivate(KEY, originalSign);
        if (Engine.getInstance().isDebug()) {
            Logger.d(TAG, "original sign: " + originalSign + "\nfinal sign: " + sign + "\nverify result: " + EncryptUtils.verifySignSHA256withRSAPublic(TEST_KEY, originalSign, sign));
        }
        return sign;
    }

    private String subPath(String path) {
        if (TextUtils.isEmpty(path)) {
            return path;
        }
        int index = 0;
        try {
            Matcher m = PATH_PATTERN.matcher(path);
            if (m.find()) {
                index = m.start();
            }
        } catch (Exception e) {
            Logger.e(e);
        }
        return path.substring(index);   //保留'/',结果为'/v1/xxx'
    }

    private String sortQuery(String query) {
        if (TextUtils.isEmpty(query) || !query.contains("&")) {
            return query;
        }
        String[] params = query.split("&");
        List<String> list = Arrays.asList(params);
        Collections.sort(list);
        StringBuilder ret = new StringBuilder();
        for (String s : list) {
            ret.append(s).append("&");
        }
        return ret.toString().substring(0, ret.length() - 1);
    }

    private void appendSignValue(StringBuilder signBuilder, String value) {
        if (TextUtils.isEmpty(value)) {
            return;
        }
        signBuilder.append(value);
    }
}

public class EncryptUtils {
    /**
     * 字节数据转字符串专用集合
     */
    private static final char[] HEX_CHAR = {'0', '1', '2', '3', '4', '5', '6',
            '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};

    /**
     * @param text 要加密的字符串
     * @return 加密的字符串
     * SHA1加密
     */
    public static String SHA1(String text) {
        try {
            MessageDigest digest = MessageDigest
                    .getInstance("SHA-1");
            digest.update(text.getBytes());
            byte messageDigest[] = digest.digest();
            // Create Hex String
            StringBuffer hexString = new StringBuffer();
            // 字节数组转换为 十六进制 数
            for (int i = 0; i < messageDigest.length; i++) {
                String shaHex = Integer.toHexString(messageDigest[i] & 0xFF);
                if (shaHex.length() < 2) {
                    hexString.append(0);
                }
                hexString.append(shaHex);
            }
            return hexString.toString();

        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }
        return "";
    }

    public static long CRC32(String text) {
        CRC32 crc32 = new CRC32();
        crc32.update(text.getBytes());
        return crc32.getValue();
    }

    /**
     * 从字符串中加载公钥
     *
     * @param publicKeyStr 公钥数据字符串
     */
    @Nullable
    public static RSAPublicKey loadPublicKey(String publicKeyStr) {
        RSAPublicKey key = null;
        try {
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.decode(publicKeyStr, Base64.DEFAULT));
            key = (RSAPublicKey) keyFactory.generatePublic(keySpec);
        } catch (NoSuchAlgorithmException e) {
            Logger.e(e);
        } catch (InvalidKeySpecException e) {
            Logger.e(e);
        } catch (NullPointerException e) {
            Logger.e(e);
        }
        return key;
    }

    /**
     * 从字符串中加载公钥
     *
     * @param privateKeyStr 密钥数据字符串
     */
    @Nullable
    public static RSAPrivateKey loadPrivateKey(String privateKeyStr) {
        RSAPrivateKey key = null;
        try {
            PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(Base64.decode(privateKeyStr, Base64.DEFAULT));
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            key = (RSAPrivateKey) keyFactory.generatePrivate(pkcs8EncodedKeySpec);
        } catch (NoSuchAlgorithmException e) {
            Logger.e(e);
        } catch (InvalidKeySpecException e) {
            Logger.e(e);
        } catch (NullPointerException e) {
            Logger.e(e);
        }
        return key;
    }

    /**
     * 公钥加密过程
     *
     * @param publicKey     公钥
     * @param plainTextData 明文数据
     * @return
     */
    @Nullable
    public static byte[] encryptRSAPublic(RSAPublicKey publicKey, byte[] plainTextData) {
        byte[] output = null;
        if (publicKey == null) {
            Logger.d("public key is empty");
            return output;
        }
        Cipher cipher = null;
        try {
            // 使用默认RSA
            cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
            // cipher= Cipher.getInstance("RSA", new BouncyCastleProvider());
            cipher.init(Cipher.ENCRYPT_MODE, publicKey);
            output = cipher.doFinal(plainTextData);
        } catch (NoSuchAlgorithmException e) {
            Logger.e(e);
        } catch (NoSuchPaddingException e) {
            Logger.e(e);
        } catch (InvalidKeyException e) {
            Logger.e(e);
        } catch (IllegalBlockSizeException e) {
            Logger.e(e);
        } catch (BadPaddingException e) {
            Logger.e(e);
        }
        return output;
    }

    @Nullable
    public static String signSHA256withRSAPrivate(RSAPrivateKey privateKey, String data) {
        String ret = null;
        try {
            Signature signature = Signature.getInstance("SHA256withRSA");
            signature.initSign(privateKey);
            signature.update(data.getBytes());
            ret = Base64.encodeToString(signature.sign(), Base64.NO_WRAP);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return ret;
    }

    public static boolean verifySignSHA256withRSAPublic(RSAPublicKey publicKey, String data, String sign) {
        boolean ret = false;
        try {
            Signature signature = Signature.getInstance("SHA256withRSA");
            signature.initVerify(publicKey);
            signature.update(data.getBytes());
            ret = signature.verify(Base64.decode(sign, Base64.NO_WRAP));
        } catch (Exception e) {
            e.printStackTrace();
        }
        return ret;
    }

    @Nullable
    public static String signMD5withRSAPrivate(RSAPrivateKey privateKey, String data) {
        String ret = null;
        try {
            Signature signature = Signature.getInstance("MD5withRSA");
            signature.initSign(privateKey);
            signature.update(data.getBytes());
            ret = Base64.encodeToString(signature.sign(), Base64.NO_WRAP);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return ret;
    }

    public static boolean verifySignMD5withRSAPublic(RSAPublicKey publicKey, String data, String sign) {
        boolean ret = false;
        try {
            Signature signature = Signature.getInstance("MD5withRSA");
            signature.initVerify(publicKey);
            signature.update(data.getBytes());
            ret = signature.verify(Base64.decode(sign, Base64.NO_WRAP));
        } catch (Exception e) {
            e.printStackTrace();
        }
        return ret;
    }

    /**
     * 利用java原生的类实现SHA256加密
     * @param str 加密后的报文
     * @author
     */
    public static String getSHA256(String str) {
        MessageDigest messageDigest;
        String encodestr = "";
        try {
            messageDigest = MessageDigest.getInstance("SHA-256");
            messageDigest.update(str.getBytes("UTF-8"));
            encodestr = byte2Hex(messageDigest.digest());
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        return encodestr;
    }

    /**
     * 将byte转为16进制
     *
     * @author CaoLu.
     */
    private static String byte2Hex(byte[] bytes) {
        StringBuffer stringBuffer = new StringBuffer();
        String temp = null;
        for (int i = 0; i < bytes.length; i++) {
            temp = Integer.toHexString(bytes[i] & 0xFF);
            if (temp.length() == 1) {
                // 1得到一位的进行补0操作
                stringBuffer.append("0");
            }
            stringBuffer.append(temp);
        }
        return stringBuffer.toString();
    }
}

最重要的是要和后端定好拼接的规则，其他的倒是没什么难点。