|
|
|
@@ -1,6 +1,7 @@ |
|
|
|
package com.iformall.interceptor; |
|
|
|
|
|
|
|
|
|
|
|
import com.alibaba.fastjson.JSON; |
|
|
|
import com.iformall.common.ErrorCode; |
|
|
|
import com.iformall.domain.po.WxThirdPartyApi; |
|
|
|
import com.iformall.exception.MallinkException; |
|
|
|
@@ -18,8 +19,12 @@ import org.springframework.data.redis.core.RedisTemplate; |
|
|
|
import org.springframework.stereotype.Component; |
|
|
|
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter; |
|
|
|
|
|
|
|
import javax.servlet.ServletException; |
|
|
|
import javax.servlet.http.HttpServletRequest; |
|
|
|
import javax.servlet.http.HttpServletResponse; |
|
|
|
import java.io.BufferedReader; |
|
|
|
import java.io.IOException; |
|
|
|
import java.io.InputStreamReader; |
|
|
|
import java.util.*; |
|
|
|
|
|
|
|
/** |
|
|
|
@@ -43,7 +48,7 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
@Override |
|
|
|
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { |
|
|
|
|
|
|
|
String cookie = request.getHeader("cookie"); |
|
|
|
String cookie = request.getHeader("appkey"); |
|
|
|
if (StringUtils.isBlank(cookie) || !cookie.contains("&")) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"非法请求"); |
|
|
|
} |
|
|
|
@@ -60,7 +65,16 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"缺少加密串"); |
|
|
|
} |
|
|
|
|
|
|
|
String timeStamp = request.getParameter("timeStamp"); |
|
|
|
String body = ((BodyReaderHttpServletRequestWrapper) request).getBody(); |
|
|
|
if(StringUtils.isBlank(body)){ |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"缺少参数"); |
|
|
|
} |
|
|
|
Map<String, String> param = StringToMap(body); |
|
|
|
if(param.isEmpty()){ |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"参数格式不正确"); |
|
|
|
} |
|
|
|
|
|
|
|
String timeStamp = param.get("timeStamp"); |
|
|
|
long timestampDate = Long.valueOf(timeStamp) + 1000*60*5;//五分钟有效 |
|
|
|
long currDate = System.currentTimeMillis(); |
|
|
|
// 请求过期 |
|
|
|
@@ -68,7 +82,7 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"请求过期"); |
|
|
|
} |
|
|
|
|
|
|
|
// String nonceStr = request.getParameter("nonceStr"); |
|
|
|
// String nonceStr = param.get("nonceStr"); |
|
|
|
// //重复调用 |
|
|
|
// Integer cache = RedisCacheUtils.getCacheInteger(redisTemplate, Constant.publicApiNonce+nonceStr); |
|
|
|
// if (null != cache) { |
|
|
|
@@ -77,28 +91,29 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Enumeration<String> paramNames = request.getParameterNames(); |
|
|
|
Map map = new HashMap(); |
|
|
|
|
|
|
|
//获取所有的请求参数 |
|
|
|
while (paramNames.hasMoreElements()) { |
|
|
|
String paramName = paramNames.nextElement(); |
|
|
|
String[] paramValues = request.getParameterValues(paramName); |
|
|
|
// Enumeration<String> paramNames = request.getParameterNames(); |
|
|
|
// Map<String, String> map = new HashMap(); |
|
|
|
// |
|
|
|
// //获取所有的请求参数 |
|
|
|
// while (paramNames.hasMoreElements()) { |
|
|
|
// String paramName = paramNames.nextElement(); |
|
|
|
// String[] paramValues = request.getParameterValues(paramName); |
|
|
|
// |
|
|
|
// if (paramValues.length > 0) { |
|
|
|
// String paramValue = paramValues[0]; |
|
|
|
// if (paramValue.length() != 0 |
|
|
|
// && !"sign".equals(paramName) |
|
|
|
// && !"appId".equals(paramName) |
|
|
|
// && !"appKey".equals(paramName) |
|
|
|
// && !"signKey".equals(paramName)) { |
|
|
|
// map.put(paramName, paramValue); |
|
|
|
// } |
|
|
|
// } |
|
|
|
// } |
|
|
|
|
|
|
|
if (paramValues.length > 0) { |
|
|
|
String paramValue = paramValues[0]; |
|
|
|
if (paramValue.length() != 0 |
|
|
|
&& !"sign".equals(paramName) |
|
|
|
&& !"appId".equals(paramName) |
|
|
|
&& !"appKey".equals(paramName) |
|
|
|
&& !"signKey".equals(paramName)) { |
|
|
|
map.put(paramName, paramValue); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
logger.info("sign={}"+signature); |
|
|
|
String signKey = apiConfig.getSignKey();//TODO 根据appId查询密钥,缓存 |
|
|
|
String newSignature = SignUtils.getSign(signKey, map, "MD5"); |
|
|
|
String newSignature = SignUtils.getSign(signKey, param, "MD5"); |
|
|
|
//加密串不匹配 |
|
|
|
if (!signature.equals(newSignature)) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"加密串校验失败"); |
|
|
|
@@ -111,4 +126,26 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
return true; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
private Map<String, String> StringToMap(String body){ |
|
|
|
Map<String, String> map = new HashMap<String, String>(); |
|
|
|
String[] keyValues = body.split("&"); |
|
|
|
for (String kv:keyValues) { |
|
|
|
if(StringUtils.isBlank(kv) || !kv.contains("=")){ |
|
|
|
continue; |
|
|
|
} |
|
|
|
String[] key_value = kv.split("="); |
|
|
|
String key = key_value[0]; |
|
|
|
if(StringUtils.isNotBlank(key) |
|
|
|
&& !"sign".equals(key) |
|
|
|
&& !"appId".equals(key) |
|
|
|
&& !"appKey".equals(key) |
|
|
|
&& !"signKey".equals(key)){ |
|
|
|
String value = kv.substring(kv.indexOf('=') + 1, kv.length()); |
|
|
|
map.put(key_value[0],value); |
|
|
|
} |
|
|
|
} |
|
|
|
return map; |
|
|
|
} |
|
|
|
|
|
|
|
} |