2. RedisConfiguration

@Configuration

public class RedisConfiguration {

@Bean

public JedisConnectionFactory jedisConnectionFactory(){

return new JedisConnectionFactory();

    }

/**

     * 支持存儲(chǔ)對(duì)象

     * @return

     */

@Bean

public RedisTemplate<String, String> redisTemplate(){

        RedisTemplate<String, String> redisTemplate = new StringRedisTemplate();

        redisTemplate.setConnectionFactory(jedisConnectionFactory());

        Jackson2JsonRedisSerializer jackson2JsonRedisSerializer = new Jackson2JsonRedisSerializer(Object.class);

        ObjectMapper objectMapper = new ObjectMapper();

        objectMapper.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);

        objectMapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL);

        jackson2JsonRedisSerializer.setObjectMapper(objectMapper);

        redisTemplate.setValueSerializer(jackson2JsonRedisSerializer);

        redisTemplate.afterPropertiesSet();

return redisTemplate;

    }

}

3. TokenController

@Slf4j

@RestController

@RequestMapping("/api/token")

public class TokenController {

@Autowired

private RedisTemplate redisTemplate;

/**

     * API Token

     *

     * @param sign

     * @return

     */

@PostMapping("/api_token")

public ApiResponse<AccessToken> apiToken(String appId, @RequestHeader("timestamp") String timestamp, @RequestHeader("sign") String sign) {

        Assert.isTrue(!StringUtils.isEmpty(appId) && !StringUtils.isEmpty(timestamp) && !StringUtils.isEmpty(sign), "參數(shù)錯(cuò)誤");

        long reqeustInterval = System.currentTimeMillis() - Long.valueOf(timestamp);

        Assert.isTrue(reqeustInterval < 5 * 60 * 1000, "請(qǐng)求過期，請(qǐng)重新請(qǐng)求");

// 1. 根據(jù)appId查詢數(shù)據(jù)庫(kù)獲取appSecret

        AppInfo appInfo = new AppInfo("1", "12345678954556");

// 2. 校驗(yàn)簽名

String signString = timestamp + appId + appInfo.getKey();

String signature = MD5Util.encode(signString);

        log.info(signature);

        Assert.isTrue(signature.equals(sign), "簽名錯(cuò)誤");

// 3. 如果正確生成一個(gè)token保存到redis中，如果錯(cuò)誤返回錯(cuò)誤信息

        AccessToken accessToken = this.saveToken(0, appInfo, null);

return ApiResponse.success(accessToken);

    }

@NotRepeatSubmit(5000)

@PostMapping("user_token")

public ApiResponse<UserInfo> userToken(String username, String password) {

// 根據(jù)用戶名查詢密碼, 并比較密碼(密碼可以RSA加密一下)

        UserInfo userInfo = new UserInfo(username, "81255cb0dca1a5f304328a70ac85dcbd", "111111");

String pwd = password + userInfo.getSalt();

String passwordMD5 = MD5Util.encode(pwd);

        Assert.isTrue(passwordMD5.equals(userInfo.getPassword()), "密碼錯(cuò)誤");

// 2. 保存Token

        AppInfo appInfo = new AppInfo("1", "12345678954556");

        AccessToken accessToken = this.saveToken(1, appInfo, userInfo);

        userInfo.setAccessToken(accessToken);

return ApiResponse.success(userInfo);

    }

private AccessToken saveToken(int tokenType, AppInfo appInfo,  UserInfo userInfo) {

String token = UUID.randomUUID().toString();

// token有效期為2小時(shí)

        Calendar calendar = Calendar.getInstance();

        calendar.setTime(new Date());

        calendar.add(Calendar.SECOND, 7200);

Date expireTime = calendar.getTime();

// 4. 保存token

        ValueOperations<String, TokenInfo> operations = redisTemplate.opsForValue();

        TokenInfo tokenInfo = new TokenInfo();

        tokenInfo.setTokenType(tokenType);

        tokenInfo.setAppInfo(appInfo);

if (tokenType == 1) {

            tokenInfo.setUserInfo(userInfo);

        }

        operations.set(token, tokenInfo, 7200, TimeUnit.SECONDS);

        AccessToken accessToken = new AccessToken(token, expireTime);

return accessToken;

    }

public static void main(String[] args) {

        long timestamp = System.currentTimeMillis();

        System.out.println(timestamp);

String signString = timestamp + "1" + "12345678954556";

String sign = MD5Util.encode(signString);

        System.out.println(sign);

        System.out.println("-------------------");

        signString = "password=123456&username=1&12345678954556" + "ff03e64b-427b-45a7-b78b-47d9e8597d3b1529815393153sdfsdfsfs" + timestamp + "A1scr6";

        sign = MD5Util.encode(signString);

        System.out.println(sign);

    }

}

4. WebMvcConfiguration

@Configuration

public class WebMvcConfiguration extends WebMvcConfigurationSupport {



private static final String[] excludePathPatterns  = {"/api/token/api_token"};



@Autowired

private TokenInterceptor tokenInterceptor;



@Override

public void addInterceptors(InterceptorRegistry registry) {

super.addInterceptors(registry);

        registry.addInterceptor(tokenInterceptor)

                .addPathPatterns("/api/**")

                .excludePathPatterns(excludePathPatterns);

    }

}

5. TokenInterceptor

@Component

public class TokenInterceptor extends HandlerInterceptorAdapter {



@Autowired

private RedisTemplate redisTemplate;



/**

     *

     * @param request

     * @param response

     * @param handler 訪問的目標(biāo)方法

     * @return

     * @throws Exception

     */

@Override

public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        String token = request.getHeader("token");

        String timestamp = request.getHeader("timestamp");

// 隨機(jī)字符串

        String nonce = request.getHeader("nonce");

        String sign = request.getHeader("sign");

        Assert.isTrue(!StringUtils.isEmpty(token) && !StringUtils.isEmpty(timestamp) && !StringUtils.isEmpty(sign), "參數(shù)錯(cuò)誤");



// 獲取超時(shí)時(shí)間

        NotRepeatSubmit notRepeatSubmit = ApiUtil.getNotRepeatSubmit(handler);

long expireTime = notRepeatSubmit == null ? 5 * 60 * 1000 : notRepeatSubmit.value();



// 2. 請(qǐng)求時(shí)間間隔

long reqeustInterval = System.currentTimeMillis() - Long.valueOf(timestamp);

        Assert.isTrue(reqeustInterval < expireTime, "請(qǐng)求超時(shí)，請(qǐng)重新請(qǐng)求");



// 3. 校驗(yàn)Token是否存在

        ValueOperations<String, TokenInfo> tokenRedis = redisTemplate.opsForValue();

        TokenInfo tokenInfo = tokenRedis.get(token);

        Assert.notNull(tokenInfo, "token錯(cuò)誤");



// 4. 校驗(yàn)簽名(將所有的參數(shù)加進(jìn)來(lái)，防止別人篡改參數(shù)) 所有參數(shù)看參數(shù)名升續(xù)排序拼接成url

// 請(qǐng)求參數(shù) + token + timestamp + nonce

        String signString = ApiUtil.concatSignString(request) + tokenInfo.getAppInfo().getKey() + token + timestamp + nonce;

        String signature = MD5Util.encode(signString);

boolean flag = signature.equals(sign);

        Assert.isTrue(flag, "簽名錯(cuò)誤");



// 5. 拒絕重復(fù)調(diào)用(第一次訪問時(shí)存儲(chǔ)，過期時(shí)間和請(qǐng)求超時(shí)時(shí)間保持一致), 只有標(biāo)注不允許重復(fù)提交注解的才會(huì)校驗(yàn)

if (notRepeatSubmit != null) {

            ValueOperations<String, Integer> signRedis = redisTemplate.opsForValue();

boolean exists = redisTemplate.hasKey(sign);

            Assert.isTrue(!exists, "請(qǐng)勿重復(fù)提交");

            signRedis.set(sign, 0, expireTime, TimeUnit.MILLISECONDS);

        }



return super.preHandle(request, response, handler);

    }

}

6. MD5Util —-MD5工具類，加密生成數(shù)字簽名

public class MD5Util {

private static final String hexDigits[] = { "0", "1", "2", "3", "4", "5",

"6", "7", "8", "9", "a", "b", "c", "d", "e", "f" };

private static String byteArrayToHexString(byte b[]) {

        StringBuffer resultSb = new StringBuffer();

for (int i = 0; i < b.length; i++)

            resultSb.append(byteToHexString(b[i]));

return resultSb.toString();

    }

private static String byteToHexString(byte b) {

int n = b;

if (n < 0)

            n += 256;

int d1 = n / 16;

int d2 = n % 16;

return hexDigits[d1] + hexDigits[d2];

    }

public static String encode(String origin) {

return encode(origin, "UTF-8");

    }

public static String encode(String origin, String charsetname) {

        String resultString = null;

try {

            resultString = new String(origin);

            MessageDigest md = MessageDigest.getInstance("MD5");

if (charsetname == null || "".equals(charsetname))

                resultString = byteArrayToHexString(md.digest(resultString

                        .getBytes()));

else

                resultString = byteArrayToHexString(md.digest(resultString

                        .getBytes(charsetname)));

        } catch (Exception exception) {

        }

return resultString;

    }

}

7. @NotRepeatSubmit ??—–自定義注解，防止重復(fù)提交。

/**

 * 禁止重復(fù)提交

 */

@Target(ElementType.METHOD)

@Retention(RetentionPolicy.RUNTIME)

public @interface NotRepeatSubmit {

/** 過期時(shí)間，單位毫秒 **/

long value() default 5000;

}

8. AccessToken

@Data

@AllArgsConstructor

public class AccessToken {

/** token */

private String token;

/** 失效時(shí)間 */

private Date expireTime;

}

9. AppInfo

@Data

@NoArgsConstructor

@AllArgsConstructor

public class AppInfo {

/** App id */

private String appId;

/** API 秘鑰 */

private String key;

}

10. TokenInfo

@Data

public class TokenInfo {

/** token類型: api:0 、user:1 */

private Integer tokenType;

/** App 信息 */

private AppInfo appInfo;

/** 用戶其他數(shù)據(jù) */

private UserInfo userInfo;

}

11. UserInfo

@Data

public class UserInfo {

/** 用戶名 */

private String username;

/** 手機(jī)號(hào) */

private String mobile;

/** 郵箱 */

private String email;

/** 密碼 */

private String password;

/** 鹽 */

private String salt;

private AccessToken accessToken;

public UserInfo(String username, String password, String salt) {

this.username = username;

this.password = password;

this.salt = salt;

    }

}

12. ApiCodeEnum

/**

 * 錯(cuò)誤碼code可以使用純數(shù)字,使用不同區(qū)間標(biāo)識(shí)一類錯(cuò)誤，也可以使用純字符，也可以使用前綴+編號(hào)

 *

 * 錯(cuò)誤碼：ERR + 編號(hào)

 *

 * 可以使用日志級(jí)別的前綴作為錯(cuò)誤類型區(qū)分 Info(I) Error(E) Warning(W)

 *

 * 或者以業(yè)務(wù)模塊 + 錯(cuò)誤號(hào)

 *

 * TODO 錯(cuò)誤碼設(shè)計(jì)

 *

 * Alipay 用了兩個(gè)code，兩個(gè)msg(https://docs.open.alipay.com/api_1/alipay.trade.pay)

 */

public enum ApiCodeEnum {

    SUCCESS("10000", "success"),

    UNKNOW_ERROR("ERR0001","未知錯(cuò)誤"),

    PARAMETER_ERROR("ERR0002","參數(shù)錯(cuò)誤"),

    TOKEN_EXPIRE("ERR0003","認(rèn)證過期"),

    REQUEST_TIMEOUT("ERR0004","請(qǐng)求超時(shí)"),

    SIGN_ERROR("ERR0005","簽名錯(cuò)誤"),

    REPEAT_SUBMIT("ERR0006","請(qǐng)不要頻繁操作"),

    ;

/** 代碼 */

private String code;

/** 結(jié)果 */

private String msg;

    ApiCodeEnum(String code, String msg) {

this.code = code;

this.msg = msg;

    }

public String getCode() {

return code;

    }

public String getMsg() {

return msg;

    }

}

13. ApiResult

@Data

@NoArgsConstructor

@AllArgsConstructor

public class ApiResult {

/** 代碼 */

private String code;

/** 結(jié)果 */

private String msg;

}

14. ApiUtil ?——-這個(gè)參考支付寶加密的算法寫的.我直接Copy過來(lái)了。

public class ApiUtil {

/**

     * 按參數(shù)名升續(xù)拼接參數(shù)

     * @param request

     * @return

     */

    public static String concatSignString(HttpServletRequest request) {

Map<String, String> paramterMap = new HashMap<>();

        request.getParameterMap().forEach((key, value) -> paramterMap.put(key, value[0]));

// 按照key升續(xù)排序，然后拼接參數(shù)

Set<String> keySet = paramterMap.keySet();

String[] keyArray = keySet.toArray(new String[keySet.size()]);

        Arrays.sort(keyArray);

        StringBuilder sb = new StringBuilder();

for (String k : keyArray) {

// 或略掉的字段

if (k.equals("sign")) {

continue;

            }

if (paramterMap.get(k).trim().length() > 0) {

// 參數(shù)值為空，則不參與簽名

                sb.append(k).append("=").append(paramterMap.get(k).trim()).append("&");

            }

        }

return sb.toString();

    }

    public static String concatSignString(Map<String, String> map) {

Map<String, String> paramterMap = new HashMap<>();

        map.forEach((key, value) -> paramterMap.put(key, value));

// 按照key升續(xù)排序，然后拼接參數(shù)

Set<String> keySet = paramterMap.keySet();

String[] keyArray = keySet.toArray(new String[keySet.size()]);

        Arrays.sort(keyArray);

        StringBuilder sb = new StringBuilder();

for (String k : keyArray) {

if (paramterMap.get(k).trim().length() > 0) {

// 參數(shù)值為空，則不參與簽名

                sb.append(k).append("=").append(paramterMap.get(k).trim()).append("&");

            }

        }

return sb.toString();

    }

/**

     * 獲取方法上的@NotRepeatSubmit注解

     * @param handler

     * @return

     */

    public static NotRepeatSubmit getNotRepeatSubmit(Object handler) {

if (handler instanceof HandlerMethod) {

            HandlerMethod handlerMethod = (HandlerMethod) handler;

            Method method = handlerMethod.getMethod();

            NotRepeatSubmit annotation = method.getAnnotation(NotRepeatSubmit.class);

return annotation;

        }

return null;

    }

}

15. ApiResponse

@Data

@Slf4j

public class ApiResponse<T> {

/** 結(jié)果 */

private ApiResult result;

/** 數(shù)據(jù) */

private T data;

/** 簽名 */

private String sign;

public static <T> ApiResponse success(T data) {

return response(ApiCodeEnum.SUCCESS.getCode(), ApiCodeEnum.SUCCESS.getMsg(), data);

    }

public static ApiResponse error(String code, String msg) {

return response(code, msg, null);

    }

public static <T> ApiResponse response(String code, String msg, T data) {

        ApiResult result = new ApiResult(code, msg);

        ApiResponse response = new ApiResponse();

        response.setResult(result);

        response.setData(data);

String sign = signData(data);

        response.setSign(sign);

return response;

    }

private static <T> String signData(T data) {

// TODO 查詢key

String key = "12345678954556";

        Map<String, String> responseMap = null;

try {

            responseMap = getFields(data);

        } catch (IllegalAccessException e) {

return null;

        }

String urlComponent = ApiUtil.concatSignString(responseMap);

String signature = urlComponent + "key=" + key;

String sign = MD5Util.encode(signature);

return sign;

    }

/**

     * @param data 反射的對(duì)象,獲取對(duì)象的字段名和值

     * @throws IllegalArgumentException

     * @throws IllegalAccessException

     */

public static Map<String, String> getFields(Object data) throws IllegalAccessException, IllegalArgumentException {

if (data == null) return null;

        Map<String, String> map = new HashMap<>();

        Field[] fields = data.getClass().getDeclaredFields();

for (int i = 0; i < fields.length; i++) {

            Field field = fields[i];

            field.setAccessible(true);

String name = field.getName();

Object value = field.get(data);

if (field.get(data) != null) {

                map.put(name, value.toString());

            }

        }

return map;

    }

}

七: ThreadLocal

ThreadLocal是線程內(nèi)的全局上下文。就是在單個(gè)線程中，方法之間共享的內(nèi)存，每個(gè)方法都可以從該上下文中獲取值和修改值。

實(shí)際案例：

在調(diào)用api時(shí)都會(huì)傳一個(gè)token參數(shù)，通常會(huì)寫一個(gè)攔截器來(lái)校驗(yàn)token是否合法，我們可以通過token找到對(duì)應(yīng)的用戶信息(User)，如果token合法，然后將用戶信息存儲(chǔ)到ThreadLocal中，這樣無(wú)論是在controller、service、dao的哪一層都能訪問到該用戶的信息。作用類似于Web中的request作用域。

傳統(tǒng)方式我們要在方法中訪問某個(gè)變量，可以通過傳參的形式往方法中傳參，如果多個(gè)方法都要使用那么每個(gè)方法都要傳參；如果使用ThreadLocal所有方法就不需要傳該參數(shù)了，每個(gè)方法都可以通過ThreadLocal來(lái)訪問該值。

• ThreadLocalUtil.set(“key”, value); 保存值

• T value = ThreadLocalUtil.get(“key”); 獲取值

ThreadLocalUtil

public class ThreadLocalUtil<T> {

    private static final ThreadLocal<Map<String, Object>> threadLocal = new ThreadLocal() {

        @Override

        protected Map<String, Object> initialValue() {

return new HashMap<>(4);

        }

    };



    public static Map<String, Object> getThreadLocal(){

return threadLocal.get();

    }



    public static <T> T get(String key) {

Map map = (Map)threadLocal.get();

return (T)map.get(key);

    }



    public static <T> T get(String key,T defaultValue) {

Map map = (Map)threadLocal.get();

return (T)map.get(key) == null ? defaultValue : (T)map.get(key);

    }



    public static void set(String key, Object value) {

Map map = (Map)threadLocal.get();

        map.put(key, value);

    }



    public static void set(Map<String, Object> keyValueMap) {

Map map = (Map)threadLocal.get();

        map.putAll(keyValueMap);

    }



    public static void remove() {

        threadLocal.remove();

    }



    public static <T> Map<String,T> fetchVarsByPrefix(String prefix) {

Map<String,T> vars = new HashMap<>();

if( prefix == null ){

return vars;

        }

Map map = (Map)threadLocal.get();

Set<Map.Entry> set = map.entrySet();



for( Map.Entry entry : set){

Object key = entry.getKey();

if( key instanceof String ){

if( ((String) key).startsWith(prefix) ){

                    vars.put((String)key,(T)entry.getValue());

                }

            }

        }

return vars;

    }



    public static <T> T remove(String key) {

Map map = (Map)threadLocal.get();

return (T)map.remove(key);

    }



    public static void clear(String prefix) {

if( prefix == null ){

return;

        }

Map map = (Map)threadLocal.get();

Set<Map.Entry> set = map.entrySet();

        List<String> removeKeys = new ArrayList<>();



for( Map.Entry entry : set ){

Object key = entry.getKey();

if( key instanceof String ){

if( ((String) key).startsWith(prefix) ){

                    removeKeys.add((String)key);

                }

            }

        }

for( String key : removeKeys ){

            map.remove(key);

        }

    }

}

總結(jié)

這個(gè)是目前第三方數(shù)據(jù)接口交互過程中常用的一些參數(shù)與使用示例，希望對(duì)大家有點(diǎn)幫助。

當(dāng)然如果為了保證更加的安全，可以加上RSA,RSA2，AES等等加密方式，保證了數(shù)據(jù)的更加的安全，但是唯一的缺點(diǎn)是加密與解密比較耗費(fèi)CPU的資源。

文章轉(zhuǎn)自微信公眾號(hào)@JAVA小咖秀

#你可能也喜歡這些API文章!

node.js + express + docker + mysql + jwt 實(shí)現(xiàn)用戶管理restful api

nodejs + mongodb 編寫 restful 風(fēng)格博客 api

表格插件wpDataTables-將 WordPress 表與 Google Sheets API 連接

手把手教你用Python和Flask創(chuàng)建REST API

使用 Django 和 Django REST 框架構(gòu)建 RESTful API：實(shí)現(xiàn) CRUD 操作

ASP.NET Web API快速入門介紹

2024年在線市場(chǎng)平臺(tái)的11大最佳支付解決方案

完整指南：如何在應(yīng)用程序中集成和使用ChatGPT API

選擇AI API的指南：ChatGPT、Gemini或Claude，哪一個(gè)最適合你？