|
|
|
@@ -1,6 +1,9 @@ |
|
|
|
package com.iformall.interceptor; |
|
|
|
|
|
|
|
|
|
|
|
import com.alibaba.fastjson.JSON; |
|
|
|
import com.alibaba.fastjson.JSONObject; |
|
|
|
import com.alibaba.fastjson.TypeReference; |
|
|
|
import com.iformall.common.ErrorCode; |
|
|
|
import com.iformall.domain.po.WxThirdPartyApi; |
|
|
|
import com.iformall.exception.MallinkException; |
|
|
|
@@ -18,8 +21,15 @@ import org.springframework.data.redis.core.RedisTemplate; |
|
|
|
import org.springframework.stereotype.Component; |
|
|
|
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter; |
|
|
|
|
|
|
|
import javax.servlet.ServletException; |
|
|
|
import javax.servlet.http.HttpServletRequest; |
|
|
|
import javax.servlet.http.HttpServletResponse; |
|
|
|
import java.io.BufferedReader; |
|
|
|
import java.io.IOException; |
|
|
|
import java.io.InputStreamReader; |
|
|
|
import java.io.UnsupportedEncodingException; |
|
|
|
import java.net.URLDecoder; |
|
|
|
import java.net.URLEncoder; |
|
|
|
import java.util.*; |
|
|
|
|
|
|
|
/** |
|
|
|
@@ -43,11 +53,13 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
@Override |
|
|
|
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { |
|
|
|
|
|
|
|
String cookie = request.getHeader("cookie"); |
|
|
|
if (StringUtils.isBlank(cookie) || !cookie.contains("&")) { |
|
|
|
response.setHeader("Content-type", "application/json;charset=UTF-8"); |
|
|
|
|
|
|
|
String appkey = request.getHeader("appkey"); |
|
|
|
if (StringUtils.isBlank(appkey) || !appkey.contains("&")) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"非法请求"); |
|
|
|
} |
|
|
|
String[] split = cookie.split("&"); |
|
|
|
String[] split = appkey.split("&"); |
|
|
|
WxThirdPartyApi apiConfig = wxThirdPartyApiService.findByApp(split[0], split[1]); |
|
|
|
if(apiConfig == null){ |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"非法请求"); |
|
|
|
@@ -60,15 +72,57 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"缺少加密串"); |
|
|
|
} |
|
|
|
|
|
|
|
String timeStamp = request.getParameter("timeStamp"); |
|
|
|
long timestampDate = Long.valueOf(timeStamp) + 1000*60*5;//五分钟有效 |
|
|
|
long currDate = System.currentTimeMillis(); |
|
|
|
// 请求过期 |
|
|
|
if (timestampDate < currDate) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"请求过期"); |
|
|
|
|
|
|
|
|
|
|
|
String body = ((BodyReaderHttpServletRequestWrapper) request).getBody(); |
|
|
|
if(StringUtils.isBlank(body)){ |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"缺少参数"); |
|
|
|
} |
|
|
|
try{ |
|
|
|
// JSONObject parameterMap = JSON.parseObject(body); |
|
|
|
Map<String, String> parameterMap = JSONObject.parseObject(body, new TypeReference<Map<String, String>>() { |
|
|
|
}); |
|
|
|
|
|
|
|
String timeStamp = parameterMap.get("timeStamp"); |
|
|
|
long timestampDate = Long.valueOf(timeStamp) + 1000*60*5;//五分钟有效 |
|
|
|
long currDate = System.currentTimeMillis(); |
|
|
|
// 请求过期 |
|
|
|
if (timestampDate < currDate) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"请求过期"); |
|
|
|
} |
|
|
|
|
|
|
|
logger.info("sign={}"+signature); |
|
|
|
String signKey = apiConfig.getSignKey();//TODO 根据appId查询密钥,缓存 |
|
|
|
String newSignature = SignUtils.getSign(signKey, parameterMap, "MD5"); |
|
|
|
//加密串不匹配 |
|
|
|
if (!signature.equals(newSignature)) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"加密串校验失败"); |
|
|
|
} |
|
|
|
Integer cache = RedisCacheUtils.getCacheInteger(redisTemplate, Constant.publicApiNonce+signature); |
|
|
|
if (null != cache) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"重复调用"); |
|
|
|
} |
|
|
|
RedisCacheUtils.cache(redisTemplate, Constant.publicApiNonce+signature, 1, 300); |
|
|
|
return true; |
|
|
|
|
|
|
|
}catch(Exception e){ |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"参数格式不正确"); |
|
|
|
} |
|
|
|
|
|
|
|
// String nonceStr = request.getParameter("nonceStr"); |
|
|
|
// Map<String, String> param = StringToMap(body); |
|
|
|
// if(param.isEmpty()){ |
|
|
|
// throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"参数格式不正确"); |
|
|
|
// } |
|
|
|
// |
|
|
|
// String timeStamp = param.get("timeStamp"); |
|
|
|
// long timestampDate = Long.valueOf(timeStamp) + 1000*60*5;//五分钟有效 |
|
|
|
// long currDate = System.currentTimeMillis(); |
|
|
|
// // 请求过期 |
|
|
|
// if (timestampDate < currDate) { |
|
|
|
// throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"请求过期"); |
|
|
|
// } |
|
|
|
|
|
|
|
// String nonceStr = param.get("nonceStr"); |
|
|
|
// //重复调用 |
|
|
|
// Integer cache = RedisCacheUtils.getCacheInteger(redisTemplate, Constant.publicApiNonce+nonceStr); |
|
|
|
// if (null != cache) { |
|
|
|
@@ -77,38 +131,69 @@ public class AuthorizationInterceptor extends HandlerInterceptorAdapter { |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Enumeration<String> paramNames = request.getParameterNames(); |
|
|
|
Map map = new HashMap(); |
|
|
|
|
|
|
|
//获取所有的请求参数 |
|
|
|
while (paramNames.hasMoreElements()) { |
|
|
|
String paramName = paramNames.nextElement(); |
|
|
|
String[] paramValues = request.getParameterValues(paramName); |
|
|
|
// Enumeration<String> paramNames = request.getParameterNames(); |
|
|
|
// Map<String, String> map = new HashMap(); |
|
|
|
// |
|
|
|
// //获取所有的请求参数 |
|
|
|
// while (paramNames.hasMoreElements()) { |
|
|
|
// String paramName = paramNames.nextElement(); |
|
|
|
// String[] paramValues = request.getParameterValues(paramName); |
|
|
|
// |
|
|
|
// if (paramValues.length > 0) { |
|
|
|
// String paramValue = paramValues[0]; |
|
|
|
// if (paramValue.length() != 0 |
|
|
|
// && !"sign".equals(paramName) |
|
|
|
// && !"appId".equals(paramName) |
|
|
|
// && !"appKey".equals(paramName) |
|
|
|
// && !"signKey".equals(paramName)) { |
|
|
|
// map.put(paramName, paramValue); |
|
|
|
// } |
|
|
|
// } |
|
|
|
// } |
|
|
|
|
|
|
|
if (paramValues.length > 0) { |
|
|
|
String paramValue = paramValues[0]; |
|
|
|
if (paramValue.length() != 0 |
|
|
|
&& !"sign".equals(paramName) |
|
|
|
&& !"appId".equals(paramName) |
|
|
|
&& !"appKey".equals(paramName) |
|
|
|
&& !"signKey".equals(paramName)) { |
|
|
|
map.put(paramName, paramValue); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
logger.info("sign={}"+signature); |
|
|
|
String signKey = apiConfig.getSignKey();//TODO 根据appId查询密钥,缓存 |
|
|
|
String newSignature = SignUtils.getSign(signKey, map, "MD5"); |
|
|
|
//加密串不匹配 |
|
|
|
if (!signature.equals(newSignature)) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"加密串校验失败"); |
|
|
|
} |
|
|
|
Integer cache = RedisCacheUtils.getCacheInteger(redisTemplate, Constant.publicApiNonce+signature); |
|
|
|
if (null != cache) { |
|
|
|
throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"重复调用"); |
|
|
|
} |
|
|
|
RedisCacheUtils.cache(redisTemplate, Constant.publicApiNonce+signature, 1, 300); |
|
|
|
return true; |
|
|
|
// logger.info("sign={}"+signature); |
|
|
|
// String signKey = apiConfig.getSignKey();//TODO 根据appId查询密钥,缓存 |
|
|
|
// String newSignature = SignUtils.getSign(signKey, param, "MD5"); |
|
|
|
// //加密串不匹配 |
|
|
|
// if (!signature.equals(newSignature)) { |
|
|
|
// throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"加密串校验失败"); |
|
|
|
// } |
|
|
|
// Integer cache = RedisCacheUtils.getCacheInteger(redisTemplate, Constant.publicApiNonce+signature); |
|
|
|
// if (null != cache) { |
|
|
|
// throw new MallinkException(ErrorCode.SYS_PARAMETER_ERROR.getCode(),"重复调用"); |
|
|
|
// } |
|
|
|
// RedisCacheUtils.cache(redisTemplate, Constant.publicApiNonce+signature, 1, 300); |
|
|
|
// return true; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
// private Map<String, String> StringToMap(String body){ |
|
|
|
// Map<String, String> map = new HashMap<String, String>(); |
|
|
|
// String bodyDecode = ""; |
|
|
|
// try { |
|
|
|
// bodyDecode = URLDecoder.decode(body, "utf-8"); |
|
|
|
// } catch (UnsupportedEncodingException e) { |
|
|
|
// e.printStackTrace(); |
|
|
|
// return map; |
|
|
|
// } |
|
|
|
// |
|
|
|
// String[] keyValues = bodyDecode.split("&"); |
|
|
|
// for (String kv:keyValues) { |
|
|
|
// if(StringUtils.isBlank(kv) || !kv.contains("=")){ |
|
|
|
// continue; |
|
|
|
// } |
|
|
|
// String[] key_value = kv.split("="); |
|
|
|
// String key = key_value[0]; |
|
|
|
// if(StringUtils.isNotBlank(key) |
|
|
|
// && !"sign".equals(key) |
|
|
|
// && !"appId".equals(key) |
|
|
|
// && !"appKey".equals(key) |
|
|
|
// && !"signKey".equals(key)){ |
|
|
|
// String value = kv.substring(kv.indexOf('=') + 1, kv.length()); |
|
|
|
// map.put(key_value[0],value); |
|
|
|
// } |
|
|
|
// } |
|
|
|
// return map; |
|
|
|
// } |
|
|
|
|
|
|
|
} |