spring mvc 添签验签方案

一、请求格式要求：

1.GET 请求

 URL示例：http://xxxxxxxx/api/test.do?a=1&b=2&c=3&d=4

2.POST请求

URL示例：http://xxxxxxxx/api/test.do

二、签名参数：

通过第一步中得到签名值后，以参数名 “signature”添加到RequestHead中。

四、验签方案：

(1) 增加一个Filter，对POST请求从inputstream中获取json参数，放到ThreadLocal中，并替换掉原来的HttpServlertRequest,因为inputStream只能读一次，如果不替换，会导致spring将参数转换为JSON时没有数据可读。（对GET请求可以不作处理）

(2) 增加一个spring mvc 拦截器，从RequestHead中取出签名，与ThreadLocal中的参数进行验证。（GET请求直接从URL中取参数）

Filter代码如下：

    @Override  
    public void doFilter(ServletRequest request, ServletResponse response,  
            FilterChain chain) throws IOException, ServletException {  
  
    	MyHttpServletRequestWrapperwrap = null;  
       if (request instanceof HttpServletRequest) {  
            HttpServletRequest httpServletRequest = (HttpServletRequest) request;  
            if ("POST".equals(httpServletRequest.getMethod().toUpperCase())  
                    && httpServletRequest.getContentType().contains("application/json")) {  
            	wrap = new MyHttpServletRequestWrapper(httpServletRequest);
            	//request = wrap;
            	TokenBag.setParam(wrap.getJsonPararms());
            }  
        }  
        if(null != wrap){
        	chain.doFilter(wrap, response); 
        }else{
        	chain.doFilter(request, response);
        }
    }

MyHttpServletRequestWrapper：用来替换原来的request对象

public class MyHttpServletRequestWrapper extends HttpServletRequestWrapper {

	private String jsonPararms;
	
	public MyHttpServletRequestWrapper(HttpServletRequest request) throws IOException{
		super(request);
		ServletInputStream  stream = this.getRequest().getInputStream();  
		jsonPararms = IOUtils.toString(stream, "UTF-8"); 
	}
	
	@Override  
    public ServletInputStream getInputStream() {  
		byte[] buffer = null;  
	     try {  
	         buffer = jsonPararms.toString().getBytes("UTF-8");  
	     } catch (UnsupportedEncodingException e) {  
	         e.printStackTrace();  
	     }  
	     final ByteArrayInputStream bais = new ByteArrayInputStream(buffer);  
	     ServletInputStream newStream = new ServletInputStream() {  
	         @Override  
	         public int read() throws IOException {  
	             return bais.read();  
	         }  
	     };  
	     return newStream;  
    }

	public String getJsonPararms() {
		return jsonPararms;
	}

	public void setJsonPararms(String jsonPararms) {
		this.jsonPararms = jsonPararms;
	}

}

mvc拦截器：

public class SignatureInterceptor extends HandlerInterceptorAdapter{

	private Logger logger = Logger.getLogger(SignatureInterceptor.class);
	
	private TokenService tokenService;
	
	/**
	 * This implementation always returns {@code true}.
	 */
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
		throws Exception {
		if(logger.isDebugEnabled()){
			logger.debug("check http request signature start...");
		}
		HandlerMethod hm = (HandlerMethod)handler;
                //通过方法上的注解来标识哪些请求需要验签
		Signature s = hm.getMethodAnnotation(Signature.class);
		if(null == s){
			return true;
		}
		String signature = request.getHeader("signature");
		if(StringUtils.isEmpty(signature)){
			logger.error("signature is empty,check signature failed...");
			response.setStatus(401);
			return false;
		}
		if("GET".equals(request.getMethod())){
			String param = request.getQueryString();
			if(checkSignature(signature,param,response)){
				//验签通过
				return super.preHandle(request,response,handler);
			}else{
				response.setStatus(401);
				return false;
			}
		}else if("POST".equals(request.getMethod())){
                        //TokenBag就是一个ThreadLocal
			String param = TokenBag.getParam();
			TokenBag.clean();
			if(StringUtils.isEmpty(param)){
				logger.error("param is empty,check signature failed...");
				response.setStatus(401);
				return false;
			}
			if(checkSignature(signature,param,response)){
				//验签通过
				return super.preHandle(request,response,handler);
			}else{
				response.setStatus(401);
				return false;
			}
		}else{
			logger.error("signature only support POST and GET");
			return false;
		}
	}

  验签方法要与加签方法一致，可以通过app和服务端使用相同的key值加密，最好是使用每个用户惟一的、动态的key值（比如token）来做。