当前位置:网站首页>Sign and authenticate API interface or H5 interface
Sign and authenticate API interface or H5 interface
2022-07-07 08:40:00 【Why not 0307】
Parameter signature authentication
To prevent client access API The interface is attacked by camouflage 、 Security risks such as data leakage . Through joint debugging with the server side, the interface security is realized , utilize API Interface signature can effectively prevent these security problems and risks . Signing interface parameters has the following advantages :
Ensure the validity of the request
Parameter changes will cause signature changes , Otherwise, it will be an invalid request ;Ensure the legitimacy of the request
The signature algorithm relies on a pair distributed by the server clientKey and secretKey,clientKey It can distinguish the identity of the caller from the client , The server can according to secretKey Determine whether the signature is legal .
Android One of the rules of client signature authentication :
Sort the parameters , Splice parameters and parameter values , Then splice the key secretKey, The last part MD5 encryption . Generate a parameter sign.
Implementation code
- Define parameter key value object
public class NetParameter {
private String key;
private String value;
public NetParameter(String key, String value) {
super();
this.key = key;
this.value = value;
}
public String getKey() {
return key;
}
public String getValue() {
return value;
}
public void setKey(String key) {
this.key = key;
}
public void setValue(String value) {
this.value = value;
}
@Override
public String toString() {
return "NetParameter [key=" + key + ", value=" + value + "]";
}
}
- Signature method
private String sign(List<NetParameter> list, String secretKey) {
StringBuffer sb = new StringBuffer();
if (list != null) {
Collections.sort(list, new Comparator<NetParameter>() {
@Override
public int compare(NetParameter lhs, NetParameter rhs) {
return lhs.getKey().compareTo(rhs.getKey());
}
});
for (int i = 0, size = list.size(); i < size; i++) {
NetParameter p = list.get(i);
if (p != null) {
sb.append(p.getKey());
sb.append("=");
sb.append(p.getValue());
}
}
}
sb.append(secretKey);
return digest(sb.toString(), "MD5");
}
- Generate public Url
private String createUrl() {
StringBuffer sb = new StringBuffer();
sb.append(link);
sb.append("?");
if (list != null) {
int j = -1;
for (int i = 0, size = list.size(); i < size; i++) {
NetParameter net = list.get(i);
if (net != null) {
String key = net.getKey();
String value = net.getValue();
if (key != null && value != null) {
if (j < 0) {
j = i;
}
if (j != i) {
sb.append("&");
}
sb.append(key);
sb.append("=");
sb.append(value);
}
}
}
}
sb.append("&");
sb.append("sign");
sb.append("=");
sb.append(sign(list, getSecretKey()));
String tmp = sb.toString();
tmp = tmp.replace("?&", "?");
return tmp;
}
Access interface
When the client generates sign Check with the server sign When not in agreement , Access failed , Feedback relevant message:“ Invalid parameter signature ”.
http://192.168.1.76:8806/#/card?clientKey=05380b3c3323541917a25b001d394bf8&rand=751d7b3c-a37b-4d8f-b169-96ca2b30f286&machineNo=7700943733234077224&productName=P770&sign=FC6DE7DECCBDDB5D909D7AC0CA589BC3
边栏推荐
- Tronapi-波场接口-源码无加密-可二开--附接口文档-基于ThinkPHP5封装-作者详细指导-2022年7月6日-新手快速上手-可无缝升级tp6版本
- 联想混合云Lenovo xCloud:4大产品线+IT服务门户
- [Yu Yue education] C language programming reference of Zhongbei College of Nanjing Normal University
- Gson转换实体类为json时报declares multiple JSON fields named
- Rainbow version 5.6 was released, adding a variety of installation methods and optimizing the topology operation experience
- SSM 整合
- 路由信息协议——RIP
- [kuangbin]专题十五 数位DP
- Obsidan之数学公式的输入
- [machine learning] watermelon book data set_ data sharing
猜你喜欢
Using nocalhost to develop microservice application on rainbow
let const
2-3 lookup tree
为什么要选择云原生数据库
下载和安装orcale database11.2.0.4
Arm GIC (IV) GIC V3 register class analysis notes.
【踩坑】nacos注册一直连接localhost:8848,no available server
Rsync remote synchronization
Merge sort and non comparison sort
Rainbow version 5.6 was released, adding a variety of installation methods and optimizing the topology operation experience
随机推荐
下载和安装orcale database11.2.0.4
路由信息协议——RIP
如何理解分布式架构和微服务架构呢
[paper reading] icml2020: can autonomous vehicles identify, recover from, and adapt to distribution shifts?
Three series of BOM elements
数据中台落地实施之法
Merge sort and non comparison sort
GFS distributed file system
opencv 将16位图像数据转为8位、8转16
grpc、oauth2、openssl、双向认证、单向认证等专栏文章目录
Improve the delivery efficiency of enterprise products (1) -- one click installation and upgrade of enterprise applications
Novice entry SCM must understand those things
Practice of implementing cloud native Devops based on rainbow library app
Grpc, oauth2, OpenSSL, two-way authentication, one-way authentication and other column directories
IP-guard助力能源企业完善终端防泄密措施,保护机密资料安全
[Chongqing Guangdong education] audio visual language reference materials of Xinyang Normal University
Implementation of navigation bar at the bottom of applet
AVL平衡二叉搜索树
National standard gb28181 protocol video platform easygbs adds streaming timeout configuration
Golang compilation constraint / conditional compilation (/ / +build < tags>)