Sign and authenticate API interface or H5 interface

Parameter signature authentication

To prevent client access API The interface is attacked by camouflage 、 Security risks such as data leakage . Through joint debugging with the server side, the interface security is realized , utilize API Interface signature can effectively prevent these security problems and risks . Signing interface parameters has the following advantages ：

• Ensure the validity of the request
  Parameter changes will cause signature changes , Otherwise, it will be an invalid request ;

• Ensure the legitimacy of the request
  The signature algorithm relies on a pair distributed by the server clientKey and secretKey,clientKey It can distinguish the identity of the caller from the client , The server can according to secretKey Determine whether the signature is legal .

Android One of the rules of client signature authentication ：
Sort the parameters , Splice parameters and parameter values , Then splice the key secretKey, The last part MD5 encryption . Generate a parameter sign.

Implementation code

• Define parameter key value object

public class NetParameter {
    
    private String key;
    private String value;

    public NetParameter(String key, String value) {
    
        super();
        this.key = key;
        this.value = value;
    }

    public String getKey() {
    
        return key;
    }

    public String getValue() {
    
        return value;
    }

    public void setKey(String key) {
    
        this.key = key;
    }

    public void setValue(String value) {
    
        this.value = value;
    }

    @Override
    public String toString() {
    
        return "NetParameter [key=" + key + ", value=" + value + "]";
    }
}

• Signature method

    private String sign(List<NetParameter> list, String secretKey) {
    
        StringBuffer sb = new StringBuffer();
        if (list != null) {
    
            Collections.sort(list, new Comparator<NetParameter>() {
    

                @Override
                public int compare(NetParameter lhs, NetParameter rhs) {
    
                    return lhs.getKey().compareTo(rhs.getKey());
                }
            });
 
            for (int i = 0, size = list.size(); i < size; i++) {
    
                NetParameter p = list.get(i);
                if (p != null) {
    
                    sb.append(p.getKey());
                    sb.append("=");
                    sb.append(p.getValue());
                }
            }
        }
        sb.append(secretKey);
        return digest(sb.toString(), "MD5");
    }

• Generate public Url

    private String createUrl() {
    
        StringBuffer sb = new StringBuffer();
        sb.append(link);
        sb.append("?");

        if (list != null) {
    
            int j = -1;
            for (int i = 0, size = list.size(); i < size; i++) {
    
                NetParameter net = list.get(i);
                if (net != null) {
    
                    String key = net.getKey();
                    String value = net.getValue();
                    if (key != null && value != null) {
    
                        if (j < 0) {
    
                            j = i;
                        }
                        if (j != i) {
    
                            sb.append("&");
                        }
                        sb.append(key);
                        sb.append("=");
                        sb.append(value);
                    }
                }
            }
        }
        sb.append("&");
        sb.append("sign");
        sb.append("=");
        sb.append(sign(list, getSecretKey()));
        String tmp = sb.toString();

        tmp = tmp.replace("?&", "?");
        return tmp;
    }

Access interface

When the client generates sign Check with the server sign When not in agreement , Access failed , Feedback relevant message：“ Invalid parameter signature ”.

http://192.168.1.76:8806/#/card?clientKey=05380b3c3323541917a25b001d394bf8&rand=751d7b3c-a37b-4d8f-b169-96ca2b30f286&machineNo=7700943733234077224&productName=P770&sign=FC6DE7DECCBDDB5D909D7AC0CA589BC3