四連問：API 接口應(yīng)該如何設(shè)計？如何保證安全？如何簽名？如何防重？

<dependency>    <groupId>org.springframework.bootgroupId>    <artifactId>spring-boot-starter-data-redisartifactId>dependency><dependency>    <groupId>redis.clientsgroupId>    <artifactId>jedisartifactId>    <version>2.9.0version>dependency>

<dependency>    <groupId>org.springframework.bootgroupId>    <artifactId>spring-boot-starter-webartifactId>dependency>

@Configurationpublic class RedisConfiguration {@Beanpublic JedisConnectionFactory jedisConnectionFactory(){return new JedisConnectionFactory();    }

/**     * 支持存儲對象     * @return     */@Beanpublic RedisTemplate<String, String> redisTemplate(){        RedisTemplate<String, String> redisTemplate = new StringRedisTemplate();        redisTemplate.setConnectionFactory(jedisConnectionFactory());        Jackson2JsonRedisSerializer jackson2JsonRedisSerializer = new Jackson2JsonRedisSerializer(Object.class);        ObjectMapper objectMapper = new ObjectMapper();        objectMapper.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);        objectMapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL);

        jackson2JsonRedisSerializer.setObjectMapper(objectMapper);        redisTemplate.setValueSerializer(jackson2JsonRedisSerializer);        redisTemplate.afterPropertiesSet();

return redisTemplate;    }}

@Slf4j@RestController@RequestMapping("/api/token")public class TokenController {

    @Autowired    private RedisTemplate redisTemplate;

    /**     * API Token     *     * @param sign     * @return     */    @PostMapping("/api_token")    public ApiResponse apiToken(String appId, @RequestHeader("timestamp") String timestamp, @RequestHeader("sign") String sign) {        Assert.isTrue(!StringUtils.isEmpty(appId) && !StringUtils.isEmpty(timestamp) && !StringUtils.isEmpty(sign), "參數(shù)錯誤");

        long reqeustInterval = System.currentTimeMillis() - Long.valueOf(timestamp);        Assert.isTrue(reqeustInterval < 5 * 60 * 1000, "請求過期，請重新請求");

        // 1. 根據(jù)appId查詢數(shù)據(jù)庫獲取appSecret        AppInfo appInfo = new AppInfo("1", "12345678954556");

        // 2. 校驗簽名        String signString = timestamp + appId + appInfo.getKey();        String signature = MD5Util.encode(signString);        log.info(signature);        Assert.isTrue(signature.equals(sign), "簽名錯誤");

        // 3. 如果正確生成一個token保存到redis中，如果錯誤返回錯誤信息        AccessToken accessToken = this.saveToken(0, appInfo, null);

        return ApiResponse.success(accessToken);    }



    @NotRepeatSubmit(5000)    @PostMapping("user_token")    public ApiResponse userToken(String username, String password) {        // 根據(jù)用戶名查詢密碼, 并比較密碼(密碼可以RSA加密一下)        UserInfo userInfo = new UserInfo(username, "81255cb0dca1a5f304328a70ac85dcbd", "111111");        String pwd = password + userInfo.getSalt();        String passwordMD5 = MD5Util.encode(pwd);        Assert.isTrue(passwordMD5.equals(userInfo.getPassword()), "密碼錯誤");

        // 2. 保存Token        AppInfo appInfo = new AppInfo("1", "12345678954556");        AccessToken accessToken = this.saveToken(1, appInfo, userInfo);        userInfo.setAccessToken(accessToken);        return ApiResponse.success(userInfo);    }

    private AccessToken saveToken(int tokenType, AppInfo appInfo,  UserInfo userInfo) {        String token = UUID.randomUUID().toString();

        // token有效期為2小時        Calendar calendar = Calendar.getInstance();        calendar.setTime(new Date());        calendar.add(Calendar.SECOND, 7200);        Date expireTime = calendar.getTime();

        // 4. 保存token        ValueOperations operations = redisTemplate.opsForValue();        TokenInfo tokenInfo = new TokenInfo();        tokenInfo.setTokenType(tokenType);        tokenInfo.setAppInfo(appInfo);

        if (tokenType == 1) {            tokenInfo.setUserInfo(userInfo);        }

        operations.set(token, tokenInfo, 7200, TimeUnit.SECONDS);

        AccessToken accessToken = new AccessToken(token, expireTime);

        return accessToken;    }

    public static void main(String[] args) {        long timestamp = System.currentTimeMillis();        System.out.println(timestamp);        String signString = timestamp + "1" + "12345678954556";        String sign = MD5Util.encode(signString);        System.out.println(sign);

        System.out.println("-------------------");        signString = "password=123456&username=1&12345678954556" + "ff03e64b-427b-45a7-b78b-47d9e8597d3b1529815393153sdfsdfsfs" + timestamp + "A1scr6";        sign = MD5Util.encode(signString);        System.out.println(sign);    }}

@Configurationpublic class WebMvcConfiguration extends WebMvcConfigurationSupport {

    private static final String[] excludePathPatterns  = {"/api/token/api_token"};

    @Autowired    private TokenInterceptor tokenInterceptor;

    @Override    public void addInterceptors(InterceptorRegistry registry) {        super.addInterceptors(registry);        registry.addInterceptor(tokenInterceptor)                .addPathPatterns("/api/**")                .excludePathPatterns(excludePathPatterns);    }}5. TokenInterceptor@Componentpublic class TokenInterceptor extends HandlerInterceptorAdapter {

    @Autowired    private RedisTemplate redisTemplate;

    /**     *     * @param request     * @param response     * @param handler 訪問的目標(biāo)方法     * @return     * @throws Exception     */    @Override    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {        String token = request.getHeader("token");        String timestamp = request.getHeader("timestamp");        // 隨機字符串        String nonce = request.getHeader("nonce");        String sign = request.getHeader("sign");        Assert.isTrue(!StringUtils.isEmpty(token) && !StringUtils.isEmpty(timestamp) && !StringUtils.isEmpty(sign), "參數(shù)錯誤");

        // 獲取超時時間        NotRepeatSubmit notRepeatSubmit = ApiUtil.getNotRepeatSubmit(handler);        long expireTime = notRepeatSubmit == null ? 5 * 60 * 1000 : notRepeatSubmit.value();

        // 2. 請求時間間隔        long reqeustInterval = System.currentTimeMillis() - Long.valueOf(timestamp);        Assert.isTrue(reqeustInterval < expireTime, "請求超時，請重新請求");

        // 3. 校驗Token是否存在        ValueOperations tokenRedis = redisTemplate.opsForValue();        TokenInfo tokenInfo = tokenRedis.get(token);        Assert.notNull(tokenInfo, "token錯誤");

        // 4. 校驗簽名(將所有的參數(shù)加進來，防止別人篡改參數(shù)) 所有參數(shù)看參數(shù)名升續(xù)排序拼接成url        // 請求參數(shù) + token + timestamp + nonce        String signString = ApiUtil.concatSignString(request) + tokenInfo.getAppInfo().getKey() + token + timestamp + nonce;        String signature = MD5Util.encode(signString);        boolean flag = signature.equals(sign);        Assert.isTrue(flag, "簽名錯誤");

        // 5. 拒絕重復(fù)調(diào)用(第一次訪問時存儲，過期時間和請求超時時間保持一致), 只有標(biāo)注不允許重復(fù)提交注解的才會校驗        if (notRepeatSubmit != null) {            ValueOperations signRedis = redisTemplate.opsForValue();            boolean exists = redisTemplate.hasKey(sign);            Assert.isTrue(!exists, "請勿重復(fù)提交");            signRedis.set(sign, 0, expireTime, TimeUnit.MILLISECONDS);        }

        return super.preHandle(request, response, handler);    }}

public class MD5Util {

    private static final String hexDigits[] = { "0", "1", "2", "3", "4", "5",            "6", "7", "8", "9", "a", "b", "c", "d", "e", "f" };

    private static String byteArrayToHexString(byte b[]) {        StringBuffer resultSb = new StringBuffer();        for (int i = 0; i < b.length; i++)            resultSb.append(byteToHexString(b[i]));
        return resultSb.toString();    }

    private static String byteToHexString(byte b) {        int n = b;        if (n < 0)            n += 256;        int d1 = n / 16;        int d2 = n % 16;        return hexDigits[d1] + hexDigits[d2];    }

    public static String encode(String origin) {        return encode(origin, "UTF-8");    }    public static String encode(String origin, String charsetname) {        String resultString = null;        try {            resultString = new String(origin);            MessageDigest md = MessageDigest.getInstance("MD5");            if (charsetname == null || "".equals(charsetname))                resultString = byteArrayToHexString(md.digest(resultString                        .getBytes()));            else                resultString = byteArrayToHexString(md.digest(resultString                        .getBytes(charsetname)));        } catch (Exception exception) {        }        return resultString;    }}

/** * 禁止重復(fù)提交 */@Target(ElementType.METHOD)@Retention(RetentionPolicy.RUNTIME)public @interface NotRepeatSubmit {    /** 過期時間，單位毫秒 **/    long value() default 5000;}

@Data@AllArgsConstructorpublic class AccessToken {    /** token */    private String token;

    /** 失效時間 */    private Date expireTime;}

@Data@NoArgsConstructor@AllArgsConstructorpublic class AppInfo {    /** App id */    private String appId;    /** API 秘鑰 */    private String key;}

@Datapublic class TokenInfo {    /** token類型: api:0 、user:1 */    private Integer tokenType;

    /** App 信息 */    private AppInfo appInfo;

    /** 用戶其他數(shù)據(jù) */    private UserInfo userInfo;}

@Datapublic class UserInfo {    /** 用戶名 */    private String username;    /** 手機號 */    private String mobile;    /** 郵箱 */    private String email;    /** 密碼 */    private String password;    /** 鹽 */    private String salt;

    private AccessToken accessToken;

    public UserInfo(String username, String password, String salt) {        this.username = username;        this.password = password;        this.salt = salt;    }}?

/** * 錯誤碼code可以使用純數(shù)字,使用不同區(qū)間標(biāo)識一類錯誤，也可以使用純字符，也可以使用前綴+編號 * * 錯誤碼：ERR + 編號 * * 可以使用日志級別的前綴作為錯誤類型區(qū)分 Info(I) Error(E) Warning(W) * * 或者以業(yè)務(wù)模塊 + 錯誤號 * * TODO 錯誤碼設(shè)計 * * Alipay 用了兩個code，兩個msg(https://docs.open.alipay.com/api_1/alipay.trade.pay) */public enum ApiCodeEnum {    SUCCESS("10000", "success"),    UNKNOW_ERROR("ERR0001","未知錯誤"),    PARAMETER_ERROR("ERR0002","參數(shù)錯誤"),    TOKEN_EXPIRE("ERR0003","認(rèn)證過期"),    REQUEST_TIMEOUT("ERR0004","請求超時"),    SIGN_ERROR("ERR0005","簽名錯誤"),    REPEAT_SUBMIT("ERR0006","請不要頻繁操作"),    ;

    /** 代碼 */    private String code;

    /** 結(jié)果 */    private String msg;

    ApiCodeEnum(String code, String msg) {        this.code = code;        this.msg = msg;    }

    public String getCode() {        return code;    }

    public String getMsg() {        return msg;    }}

@Data@NoArgsConstructor@AllArgsConstructorpublic class ApiResult {

/** 代碼 */private String code;

/** 結(jié)果 */private String msg;}

public class ApiUtil {

/**     * 按參數(shù)名升續(xù)拼接參數(shù)     * @param request     * @return     */    public static String concatSignString(HttpServletRequest request) {Map paramterMap = new HashMap<>();        request.getParameterMap().forEach((key, value) -> paramterMap.put(key, value[0]));// 按照key升續(xù)排序，然后拼接參數(shù)Set keySet = paramterMap.keySet();String[] keyArray = keySet.toArray(new String[keySet.size()]);        Arrays.sort(keyArray);        StringBuilder sb = new StringBuilder();for (String k : keyArray) {// 或略掉的字段if (k.equals("sign")) {continue;            }if (paramterMap.get(k).trim().length() > 0) {// 參數(shù)值為空，則不參與簽名                sb.append(k).append("=").append(paramterMap.get(k).trim()).append("&");            }        }

return sb.toString();    }

    public static String concatSignString(Map map) {Map paramterMap = new HashMap<>();        map.forEach((key, value) -> paramterMap.put(key, value));// 按照key升續(xù)排序，然后拼接參數(shù)Set keySet = paramterMap.keySet();String[] keyArray = keySet.toArray(new String[keySet.size()]);        Arrays.sort(keyArray);        StringBuilder sb = new StringBuilder();for (String k : keyArray) {if (paramterMap.get(k).trim().length() > 0) {// 參數(shù)值為空，則不參與簽名                sb.append(k).append("=").append(paramterMap.get(k).trim()).append("&");            }        }return sb.toString();    }

/**     * 獲取方法上的@NotRepeatSubmit注解     * @param handler     * @return     */    public static NotRepeatSubmit getNotRepeatSubmit(Object handler) {if (handler instanceof HandlerMethod) {            HandlerMethod handlerMethod = (HandlerMethod) handler;            Method method = handlerMethod.getMethod();            NotRepeatSubmit annotation = method.getAnnotation(NotRepeatSubmit.class);

return annotation;        }

return null;    }}

@Data@Slf4jpublic class ApiResponse {/** 結(jié)果 */private ApiResult result;

/** 數(shù)據(jù) */private T data;

/** 簽名 */private String sign;



public static  ApiResponse success(T data) {return response(ApiCodeEnum.SUCCESS.getCode(), ApiCodeEnum.SUCCESS.getMsg(), data);    }

public static ApiResponse error(String code, String msg) {return response(code, msg, null);    }

public static  ApiResponse response(String code, String msg, T data) {        ApiResult result = new ApiResult(code, msg);        ApiResponse response = new ApiResponse();        response.setResult(result);        response.setData(data);

String sign = signData(data);        response.setSign(sign);

return response;    }

private static  String signData(T data) {// TODO 查詢keyString key = "12345678954556";        Map responseMap = null;try {            responseMap = getFields(data);        } catch (IllegalAccessException e) {return null;        }String urlComponent = ApiUtil.concatSignString(responseMap);String signature = urlComponent + "key=" + key;String sign = MD5Util.encode(signature);

return sign;    }

/**     * @param data 反射的對象,獲取對象的字段名和值     * @throws IllegalArgumentException     * @throws IllegalAccessException     */public static Map getFields(Object data) throws IllegalAccessException, IllegalArgumentException {if (data == null) return null;        Map map = new HashMap<>();        Field[] fields = data.getClass().getDeclaredFields();for (int i = 0; i < fields.length; i++) {            Field field = fields[i];            field.setAccessible(true);

String name = field.getName();Object value = field.get(data);if (field.get(data) != null) {                map.put(name, value.toString());            }        }

return map;    }}

public class ThreadLocalUtil {    private static final ThreadLocal> threadLocal = new ThreadLocal() {        @Override        protected Map initialValue() {return new HashMap<>(4);        }    };



    public static Map getThreadLocal(){return threadLocal.get();    }

    public static  T get(String key) {Map map = (Map)threadLocal.get();return (T)map.get(key);    }

    public static  T get(String key,T defaultValue) {Map map = (Map)threadLocal.get();return (T)map.get(key) == null ? defaultValue : (T)map.get(key);    }

    public static void set(String key, Object value) {Map map = (Map)threadLocal.get();        map.put(key, value);    }

    public static void set(Map keyValueMap) {Map map = (Map)threadLocal.get();        map.putAll(keyValueMap);    }

    public static void remove() {        threadLocal.remove();    }

    public static  Map fetchVarsByPrefix(String prefix) {Map vars = new HashMap<>();if( prefix == null ){return vars;        }Map map = (Map)threadLocal.get();Set set = map.entrySet();

for( Map.Entry entry : set){Object key = entry.getKey();if( key instanceof String ){if( ((String) key).startsWith(prefix) ){                    vars.put((String)key,(T)entry.getValue());                }            }        }return vars;    }

    public static  T remove(String key) {Map map = (Map)threadLocal.get();return (T)map.remove(key);    }

    public static void clear(String prefix) {if( prefix == null ){return;        }Map map = (Map)threadLocal.get();Set set = map.entrySet();        List removeKeys = new ArrayList<>();

for( Map.Entry entry : set ){Object key = entry.getKey();if( key instanceof String ){if( ((String) key).startsWith(prefix) ){                    removeKeys.add((String)key);                }            }        }for( String key : removeKeys ){            map.remove(key);        }    }}