發布一個HTTP接口

1.簽名驗證的工具類:

　　簽名規則：

1. 將所有請求參數轉成JSON字符串。
2. 將請求密鑰分別添加到上述JSON字符串的頭部和尾部，格式如下：

　　　　　　secret請求參數JSON字符串secret。

　　3. 對該字符串進行MD5（簽名）運算，得到一個二進制數組。

　　4. 將該二進制數組轉換為一個十六進制的字符串，該字符串是這些請求參數的簽名。

/**
 * 請求參數簽名工具類
 *
 */
public class ParamSignUtils {

    public static void main(String[] args) {
        HashMap<String, String> signMap = new HashMap<String, String>();
        String secret = "ywwXMYoWoS63u26fB1r4U";
        HashMap SignHashMap = ParamSignUtils.sign(signMap, secret);
        System.out.println("SignHashMap:" + SignHashMap);
        List<String> ignoreParamNames = new ArrayList<String>();
        ignoreParamNames.add("a");
        HashMap SignHashMap2 = ParamSignUtils.sign(signMap, ignoreParamNames, secret);
        System.out.println("SignHashMap2:" + SignHashMap2);
    }

    public static HashMap<String, String> sign(Map<String, String> paramValues, String secret) {
        return sign(paramValues, null, secret);
    }

    /**
     * @param paramValues
     * @param ignoreParamNames
     * @param secret
     * @return
     */
    public static HashMap<String, String> sign(Map<String, String> paramValues, List<String> ignoreParamNames,
            String secret) {
        try {
            HashMap<String, String> signMap = new HashMap<String, String>();
            StringBuilder sb = new StringBuilder();
            List<String> paramNames = new ArrayList<String>(paramValues.size());
            paramNames.addAll(paramValues.keySet());
            if (ignoreParamNames != null && ignoreParamNames.size() > 0) {
                for (String ignoreParamName : ignoreParamNames) {
                    paramNames.remove(ignoreParamName);
                }
            }
            Collections.sort(paramNames);
            sb.append(secret);
            for (String paramName : paramNames) {
                sb.append(paramName).append(paramValues.get(paramName));
            }
            sb.append(secret);
            byte[] md5Digest = getMD5Digest(sb.toString());
            String sign = byte2hex(md5Digest);
            signMap.put("appParam", sb.toString());
            signMap.put("appSign", sign);
            return signMap;
        } catch (IOException e) {
            throw new RuntimeException("加密簽名計算錯誤", e);
        }

    }

    /**
     * @param paramValues
     * @param ignoreParamNames
     * @param secret
     * @return
     */
    public static HashMap<String, String> sign(String paramValues, String secret) {
        try {
            HashMap<String, String> signMap = new HashMap<String, String>();
            StringBuilder sb = new StringBuilder(secret);
            if(!StringUtils.isBlank(paramValues)){
                sb.append(paramValues);
            }
            sb.append(secret);
            byte[] md5Digest = getMD5Digest(sb.toString());
            String sign = byte2hex(md5Digest);
            signMap.put("appParam", sb.toString());
            signMap.put("appSign", sign);
            return signMap;
        } catch (IOException e) {
            throw new RuntimeException("加密簽名計算錯誤", e);
        }

    }

    public static String utf8Encoding(String value, String sourceCharsetName) {
        try {
            return new String(value.getBytes(sourceCharsetName), "UTF-8");
        } catch (UnsupportedEncodingException e) {
            throw new IllegalArgumentException(e);
        }
    }

    private static byte[] getSHA1Digest(String data) throws IOException {
        byte[] bytes = null;
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-1");
            bytes = md.digest(data.getBytes("UTF-8"));
        } catch (GeneralSecurityException gse) {
            throw new IOException(gse);
        }
        return bytes;
    }

    private static byte[] getMD5Digest(String data) throws IOException {
        byte[] bytes = null;
        try {
            MessageDigest md = MessageDigest.getInstance("MD5");
            bytes = md.digest(data.getBytes("UTF-8"));
        } catch (GeneralSecurityException gse) {
            throw new IOException(gse);
        }
        return bytes;
    }

    private static String byte2hex(byte[] bytes) {
        StringBuilder sign = new StringBuilder();
        for (int i = 0; i < bytes.length; i++) {
            String hex = Integer.toHexString(bytes[i] & 0xFF);
            if (hex.length() == 1) {
                sign.append("0");
            }
            sign.append(hex.toUpperCase());
        }
        return sign.toString();
    }

}

2.獲取HttpServletRequest的原生JSON參數

//獲取請求JSON字符串
    private String getParams(HttpServletRequest req) {
        String result = null;
        try {
            // 包裝request的輸入流
            BufferedReader br = new BufferedReader(
            new InputStreamReader((ServletInputStream) req.getInputStream(), "utf-8"));
            // 緩沖字符
            StringBuffer sb = new StringBuffer("");
            String line;
            while ((line = br.readLine()) != null) {
                sb.append(line);
            }
            br.close();// 關閉緩沖流
            result = sb.toString();// 轉換成字符
            System.out.println("result = " + result);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return result;
    }

3.接口的具體實現

@RequestMapping(value = "/getNoticeStockOutHeader", method = RequestMethod.POST)
    @ResponseBody
    public ResponseIntf getNoticeStockOutHeader(HttpServletRequest request, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");// 跨域訪問
        response.setCharacterEncoding("utf-8");
        ResponseIntf res = new ResponseIntf();
        try {
            request.setCharacterEncoding("utf-8");
            String json = this.getParams(request).replaceAll("\\s*", "");//去掉所有空格
            String sign = request.getHeader("sign");
            if(StringUtils.isBlank(sign)){
                throw new SecurityException("接口簽名不能為空！");
            }
            if(!validateSign(json,sign)){
                throw new SecurityException("簽名驗證不通過！");
            }
            Gson gson = new Gson();
            RequestIntf req = gson.fromJson(json, RequestIntf.class);
            res.setResult(noticeStockOutService.getNoticeStockOutHeaderList(req));
            res.setSuccess(true);
            res.setMessage("調用成功");
        } catch (IllegalArgumentException e) {
            e.printStackTrace();
            logger.error(StringUtils.getStackTrace(e));
            res.setSuccess(false);
            res.setMessage("參數不合法！錯誤信息：" + e.getMessage());
        } catch (SecurityException e) {
            e.printStackTrace();
            logger.error(StringUtils.getStackTrace(e));
            res.setSuccess(false);
            res.setMessage("安全異常：" + e.getMessage());
        } catch (AppException e) {
            res.setSuccess(false);
            res.setMessage(e.getMessage());
        } catch (Exception e) {
            e.printStackTrace();
            logger.error(StringUtils.getStackTrace(e));
            res.setSuccess(false);
            res.setMessage("其它異常：" + e.getMessage());
        }
        return res;
    }

4.接口采用MD5加密，直接獲取原生的JSON字符串近行加密，與存放在request的header中的sign進行比對，相等，則驗證成功。