1、業(yè)務(wù)背景
最近接觸了一些電商業(yè)務(wù)，發(fā)現(xiàn)在處理電商業(yè)務(wù)接口時(shí)，比如淘寶、支付類接口，接口雙方為了確保數(shù)據(jù)參數(shù)在傳輸過(guò)程中未經(jīng)過(guò)篡改，都需要對(duì)接口數(shù)據(jù)進(jìn)行加簽，然后在接口服務(wù)器端對(duì)接口參數(shù)進(jìn)行驗(yàn)簽，確保兩個(gè)簽名是一樣的，驗(yàn)簽通過(guò)之后再進(jìn)行業(yè)務(wù)邏輯處理。我們這里主要介紹一下處理思路，至于簽名算法我不做過(guò)多介紹，網(wǎng)上一大堆。
2、處理思路
雙方約定好，參數(shù)按特定順序排列，比如按首字母的順序排列，如url:http://xxx/xxx.do?a=wersd&b=sd2354&c=4&signature=XXXXXXXXXXXX(signature為傳入的簽名)，等你拿到入?yún)⒑螅瑢?shù)串a(chǎn)=wersd&b=sd2354&c=4按你們約定的簽名規(guī)則，自己用md5加簽一次，然后和入?yún)⒌膕ignature值對(duì)比，以確認(rèn)調(diào)用者是否合法，這就是接口簽名驗(yàn)證的思路。
3、實(shí)例練習(xí)
接口雙方經(jīng)過(guò)溝通，對(duì)接口達(dá)成如下共識(shí)：
1、注意事項(xiàng)，主要指接口的的協(xié)議、傳入?yún)?shù)類型、簽名算法、文件格式等說(shuō)明
2、下面是一個(gè)電商業(yè)務(wù)接口的真實(shí)案例，雙方約定好了接口URL、業(yè)務(wù)參數(shù)、固定參數(shù)、簽名以及返回?cái)?shù)據(jù)格式
接口調(diào)用時(shí)，接口調(diào)用方代碼如下(僅供參考)：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
package com.pcmall;import java.io.BufferedReader; import java.io.DataOutputStream; import java.io.IOException; import java.io.InputStreamReader; import java.io.UnsupportedEncodingException; import java.net.HttpURLConnection; import java.net.URL; import java.net.URLEncoder; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.util.ArrayList; import java.util.Collections; import java.util.Iterator; import java.util.List; import java.util.Map; import java.util.TreeMap; public class APITest { static String TEST_URL = "待定"; static String TEST_KEY = "待定"; static String TEST_SEC = "待定"; public static void main(String[] args) throws UnsupportedEncodingException, NoSuchAlgorithmException { String result = getResult(TEST_URL, getReqParam()); System.out.print(result); } private static String getReqParam() throws UnsupportedEncodingException, NoSuchAlgorithmException { TreeMap<String, String> req = new TreeMap<String, String>(); req.put("a", TEST_KEY); req.put("f", "json"); req.put("l", "zh_CN"); req.put("m", "zhongan.repair.query"); req.put("v", "1.0"); req.put("i", "" + System.currentTimeMillis() / 1000); req.put("params", "{\"assignNo\":\"TEST018\"}"); req.put("s", sign(req, null, TEST_SEC)); StringBuilder param = new StringBuilder(); for (Iterator<Map.Entry<String, String>> it = req.entrySet().iterator(); it.hasNext();) { Map.Entry<String, String> e = it.next(); param.append("&").append(e.getKey()).append("=").append(URLEncoder.encode(e.getValue(), "UTF-8")); } return param.toString().substring(1); } private static String sign(Map<String, String> paramValues, List<String> ignoreParamNames, String secret) throws NoSuchAlgorithmException, UnsupportedEncodingException { StringBuilder sb = new StringBuilder(); List<String> paramNames = new ArrayList<String>(paramValues.size()); paramNames.addAll(paramValues.keySet()); if (ignoreParamNames != null && ignoreParamNames.size() > 0) { for (String ignoreParamName : ignoreParamNames) { paramNames.remove(ignoreParamName); } } Collections.sort(paramNames); sb.append(secret); for (String paramName : paramNames) { sb.append(paramName).append(paramValues.get(paramName)); } sb.append(secret); MessageDigest md = MessageDigest.getInstance("SHA-1"); return byte2hex(md.digest(sb.toString().getBytes("UTF-8"))); } private static String byte2hex(byte[] bytes) { StringBuilder sign = new StringBuilder(); for (int i = 0; i < bytes.length; i++) { String hex = Integer.toHexString(bytes[i] & 0xFF); if (hex.length() == 1) { sign.append("0"); } sign.append(hex.toUpperCase()); } return sign.toString(); } private static String getResult(String urlStr, String content) { URL url = null; HttpURLConnection connection = null; try { url = new URL(urlStr); connection = (HttpURLConnection) url.openConnection(); connection.setDoOutput(true); connection.setDoInput(true); connection.setRequestMethod("POST"); connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded;charset=UTF-8"); connection.setUseCaches(false); connection.connect(); DataOutputStream out = new DataOutputStream(connection.getOutputStream()); out.write(content.getBytes("UTF-8")); out.flush(); out.close(); BufferedReader reader = new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8")); StringBuffer buffer = new StringBuffer(); String line = ""; while ((line = reader.readLine()) != null) { buffer.append(line); } reader.close(); return buffer.toString(); } catch (IOException e) { e.printStackTrace(); } finally { if (connection != null) { connection.disconnect(); } } return null; } } |
服務(wù)器端代碼如下(僅供參考)：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
@RequestMapping("/repairTakeOrder") @ResponseBody public ResponseVO repairTakeOrder(@RequestBody String jsonStr) { logger.info("repairTakeOrder入?yún)ⅲ?quot; + jsonStr); ResponseVO responseVO = null; try { RepairOrder repairOrder = JackJsonUtil.toBean(jsonStr, RepairOrder.class); TreeMap<String, String> paramsMap = new TreeMap<String, String>(); paramsMap.put("gsxx01", repairOrder.getGsxx01()); paramsMap.put("orderType", repairOrder.getOrderType().toString()); paramsMap.put("serviceNo", repairOrder.getServiceNo()); paramsMap.put("vipCard", repairOrder.getVipCard()); paramsMap.put("customerName", repairOrder.getCustomerName()); paramsMap.put("customerPhone", repairOrder.getCustomerPhone()); paramsMap.put("customerTel", repairOrder.getCustomerTel()); paramsMap.put("province", repairOrder.getProvince()); paramsMap.put("city", repairOrder.getCity()); paramsMap.put("county", repairOrder.getCounty()); paramsMap.put("address", repairOrder.getAddress()); paramsMap.put("salerCode", repairOrder.getSalerCode()); paramsMap.put("salerName", repairOrder.getSalerName()); paramsMap.put("storeCode", repairOrder.getStoreCode()); paramsMap.put("storeName", repairOrder.getStoreName()); paramsMap.put("site", repairOrder.getSite()); paramsMap.put("siteDesp", repairOrder.getSiteDesp()); paramsMap.put("engineerCode", repairOrder.getEngineerCode()); paramsMap.put("engineerName", repairOrder.getEngineerName()); if (repairOrder.getServiceDate() != null) { paramsMap.put("serviceDate", DateUtils.formatDate(repairOrder.getServiceDate())); } if (repairOrder.getSalePrice() != null) { paramsMap.put("salePrice", repairOrder.getSalePrice() .toString()); } paramsMap.put("profitCenter", repairOrder.getProfitCenter()); paramsMap.put("costCenter", repairOrder.getCostCenter()); paramsMap.put("gsxx02", repairOrder.getGsxx02()); paramsMap.put("returnReason", repairOrder.getReturnReason()); if (repairOrder.getOriOrder() != null) { paramsMap.put("oriOrder", repairOrder.getOriOrder().toString()); } if (repairOrder.getOriServiceNo() != null) { paramsMap.put("oriServiceNo", repairOrder.getOriServiceNo()); } // 拼接簽名原串(a=1&b=2) String paramSrc = RequestUtils.getParamSrc(paramsMap); logger.info("簽名原串：" + paramSrc); //進(jìn)行驗(yàn)簽操作 if (SignUtils.verifymd5(paramSrc, repairOrder.getSign())) { //處理業(yè)務(wù)邏輯 responseVO=erpServiceImpl.repairTakeOrder(repairOrder); } else { responseVO = new ResponseVO(); responseVO.setSuccess(false); responseVO.setErrorMsg("驗(yàn)簽失敗"); } } catch (Exception e) { logger.error("", e); responseVO = new ResponseVO(); responseVO.setSuccess(false); responseVO.setErrorMsg(StringUtils.isNotBlank(e.getMessage()) ? e.getMessage() : "后臺(tái)異常"); } return responseVO; } |
以上這篇Java Http接口加簽、驗(yàn)簽操作方法就是小編分享給大家的全部?jī)?nèi)容了，希望能給大家一個(gè)參考，也希望大家多多支持服務(wù)器之家。
