请求签名

1、https可以保证信道安全，但是不能保证数据源安全，所以可以对请求头签名的方式。

2、签名方法

using HRS.Lib.Comm.Exceptions;
using HRS.Lib.Comm.Memory;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Configuration;
using System.Linq;
using System.Net.Http.Headers;
using System.Security.Cryptography;
using System.Text;
using System.Web;

namespace HRS.Web.Helper
{
    /// <summary>
    /// 请求头签名
    /// </summary>
    public static class SignHelper
    {
        private static string[] _AllKeys = ConfigurationManager.AppSettings.AllKeys;
        private static ConcurrentDictionary<string, string> _cDic = new ConcurrentDictionary<string, string>();

        /// <summary>
        /// 校验
        /// </summary>
        /// <param name="headers"></param>
        public static bool Check(HttpRequestHeaders headers)
        {
            // 1、校验请求头
            var dicKeys = ValidateHeader(headers);

            // 2、校验签名
            var signStr = Sign(dicKeys);
            var signature = headers.GetValues("signature").First();
            if (signStr != signature)
            {
                throw new ShowInfoException("【调试阶段提示】签名失败：应该是{0}，而不是{1}", signStr, signature);
            }

            // 3、防重放攻击
            ReplayAttack(dicKeys["timestamp"], dicKeys["xReqNonce"]);

            return true;
        }

        /// <summary>
        /// 校验请求头
        /// </summary>
        /// <param name="headers"></param>
        /// <returns></returns>
        private static Dictionary<string, string> ValidateHeader(HttpRequestHeaders headers)
        {
            Dictionary<String, String> dicKeys = new Dictionary<String, String>();

            if (!headers.Contains("appKey")) throw new ShowInfoException("请求头缺省appKey");
            if (!headers.Contains("timestamp")) throw new ShowInfoException("请求头缺省timestamp");
            if (!headers.Contains("version")) throw new ShowInfoException("请求头缺省version");
            if (!headers.Contains("xReqNonce")) throw new ShowInfoException("请求头缺省xReqNonce");
            if (!headers.Contains("signature")) throw new ShowInfoException("请求头缺省signature");

            var appKey = headers.GetValues("appKey").First();
            var timestamp = headers.GetValues("timestamp").First();
            var version = headers.GetValues("version").First();
            var xReqNonce = headers.GetValues("xReqNonce").First();
            var signature = headers.GetValues("signature").First();

            if (string.IsNullOrEmpty(appKey)) throw new ShowInfoException("请求头缺省appKey");
            if (string.IsNullOrEmpty(timestamp)) throw new ShowInfoException("请求头缺省timestamp");
            if (string.IsNullOrEmpty(version)) throw new ShowInfoException("请求头缺省version");
            if (string.IsNullOrEmpty(xReqNonce)) throw new ShowInfoException("请求头缺省xReqNonce");
            if (string.IsNullOrEmpty(signature)) throw new ShowInfoException("请求头缺省signature");

            // 校验
            ValidateAppKey(appKey);

            dicKeys.Add("appKey", appKey);
            dicKeys.Add("appSecret", GetAppSecret(appKey));
            dicKeys.Add("timestamp", headers.GetValues("timestamp").First());
            dicKeys.Add("version", headers.GetValues("version").First());
            dicKeys.Add("xReqNonce", headers.GetValues("xReqNonce").First());
            return dicKeys;
        }

        /// <summary>
        /// 获取appSecret
        /// </summary>
        /// <param name="appKey"></param>
        /// <returns></returns>
        private static void ValidateAppKey(string appKey)
        {
            if (!_AllKeys.Any(p => p == appKey))
            {
                throw new ShowInfoException("请求头appKey不存在");
            }
        }

        /// <summary>
        /// 签名验证
        /// </summary>
        /// <param name="dicKeys"></param>
        /// <param name="signature"></param>
        private static string Sign(Dictionary<string, string> dicKeys)
        {
            // 1、 将以上key=value对的value进行合并,生成一下字符串builder
            StringBuilder builder = new StringBuilder();
            foreach (var item in dicKeys)
            {
                builder.Append(item.Value);
            }

            // 2.、将生成的builder进行Url编码
            string urlBuilder = HttpUtility.UrlEncode(builder.ToString(), Encoding.UTF8);
            Console.WriteLine(urlBuilder);

            // 3、签名
            var encoding = new System.Text.UTF8Encoding();
            byte[] keyByte = encoding.GetBytes(dicKeys["appSecret"]);
            byte[] messageBytes = encoding.GetBytes(urlBuilder);
            using (var hmacsha256 = new HMACSHA256(keyByte))
            {
                byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);
                return Convert.ToBase64String(hashmessage);
            }
        }

        /// <summary>
        /// 获取appSecret
        /// </summary>
        /// <param name="appKey"></param>
        /// <returns></returns>
        private static string GetAppSecret(string appKey)
        {
            if (!_cDic.ContainsKey(appKey))
            {
                _cDic[appKey] = ConfigurationManager.AppSettings[appKey];
            }
            return _cDic[appKey];
        }

        private static object obj = new object();
        /// <summary>
        /// 防重放
        /// </summary>
        /// <param name="timestamp"></param>
        /// <param name="xReqNonce"></param>
        private static void ReplayAttack(string timestamp, string xReqNonce)
        {
            var stamp = CacheMemory<Object>.GetCache(timestamp + xReqNonce);
            if (stamp == null)
            {
                CacheMemory<Object>.SetCache(timestamp + xReqNonce, obj, DateTime.Now.AddSeconds(60));  // 60秒
            }
            else
            {
                throw new ShowInfoException("您访问太频繁了！");
            }
        }
    }
}

3、服务端（缺省数据库实现）

        // POST api/UserLogin/ApiToken
        [HttpPost]
        [AllowAnonymous]
        [ActionName("ApiToken")]
        public ApiTokenResponeModel ApiToken(ApiTokenRequestModel model)
        {
            var respone = new ApiTokenResponeModel();
            try
            {
                // 请求头校验
                respone.issuccess = SignHelper.Check(Request.Headers);

                // 登录校验
                var appKey = Request.Headers.GetValues("appKey").First();
                respone.registered = Registered(model, appKey);

                // 生成jwt
                if(respone.registered) respone.access_token = TokenHelper.GenerateToken(model.businesslicenseNo, 5);
            }
            catch (ShowInfoException e)
            {
                respone.msg = e.Message;
            }
            catch (Exception ex)
            {
                respone.msg = ex.Message;
                BusinessEngine.Logger.Error(ex);
            }
            return respone;
        }

        // POST api/UserLogin/Register
        [HttpPost]
        [AllowAnonymous]
        [ActionName("Register")]
        public RegisterResponeModel Register(RegisterRequestModel model)
        {
            var respone = new RegisterResponeModel();
            try
            {
                // 请求头校验
                SignHelper.Check(Request.Headers);

                // 注册
                var appKey = Request.Headers.GetValues("appKey").First();
                Register(model, appKey);

                // 生成jwt
                respone.access_token = TokenHelper.GenerateToken(model.businesslicenseNo, 5);

                respone.issuccess = true;
            }
            catch (ShowInfoException e)
            {
                respone.msg = e.Message;
            }
            catch (Exception ex)
            {
                respone.msg = ex.Message;
                BusinessEngine.Logger.Error(ex);
            }
            return respone;
        }

4、客户端

using System;
using System.Collections.Generic;
using System.Text;
using System.Security.Cryptography;
using System.Net;
using System.Web;
using System.IO;

namespace ConsoleApplication2
{
    class Program
    {
        static void Main(string[] args)
        {
            string appKey = "1111111111111111111";
            string appSecret = "2222222222";
            // 1970至今的时差,
            //string timestamp = ((DateTime.Now.ToUniversalTime().Ticks - 621355968000000000) / 1000).ToString();
            string timestamp = "16473983036990";

            string version = "1.0.0";
            // string xReqNonce = Guid.NewGuid().ToString().Replace("-", "");
            string xReqNonce = "24213r42fd"; // 错的


            // 1、按Key字典顺序
            Dictionary<String, String> dicKeys = new Dictionary<String, String>();
            dicKeys.Add("appKey", appKey);
            dicKeys.Add("appSecret", appSecret);
            dicKeys.Add("timestamp", timestamp);
            dicKeys.Add("version", version);
            dicKeys.Add("xReqNonce", xReqNonce);

            // 2、 将以上key=value对的value进行合并,生成一下字符串builder
            StringBuilder builder = new StringBuilder();
            foreach (var item in dicKeys)
            {
                builder.Append(item.Value);
            }
            Console.WriteLine(builder.ToString());

            // 3.、将生成的builder进行Url编码
            string urlBuilder = HttpUtility.UrlEncode(builder.ToString(), Encoding.UTF8);
            Console.WriteLine(urlBuilder);

            // 4、签名
            var encoding = new System.Text.UTF8Encoding();
            byte[] keyByte = encoding.GetBytes(appSecret);
            byte[] messageBytes = encoding.GetBytes(urlBuilder);
            using (var hmacsha256 = new HMACSHA256(keyByte))
            {
                byte[] hashmessage = hmacsha256.ComputeHash(messageBytes);
                string signStr = Convert.ToBase64String(hashmessage);
                dicKeys.Add("signature", signStr);
                Console.WriteLine(signStr);
            }

            var url = "http://localhost:8888/api/UserLogin/ApiToken";
            dicKeys.RemoveKey("appSecret"); // 移除Header中的appSecret
            //var json = JsonConvert.SerializeObject(new {BusinesslicenseNo="913303821455606740"});
            var json = "{\"BusinesslicenseNo\":\"913303821455606740\"}";
            try
            {
                var responeJson = GetResponseString(url, dicKeys, json);
            }
            catch (Exception e)
            {
                // TODO
            }

            Console.ReadKey();
        }

        /// <summary>
        /// 获取请求的数据
        /// </summary>
        /// <param name="strUrl">请求地址</param>
        /// <param name="dicHeaders">请求头</param>
        /// <param name="jsonParameters">json参数</param>
        /// <returns>返回：请求成功响应信息，失败返回null</returns>
        public static string GetResponseString(string strUrl, Dictionary<string, string> dicHeaders, string jsonParameters)
        {
            HttpWebRequest webRequest = (HttpWebRequest)WebRequest.Create(strUrl);

            HttpWebResponse webResponse = PostRequest(webRequest, dicHeaders, jsonParameters);

            if (webResponse != null && webResponse.StatusCode == HttpStatusCode.OK)
            {
                using (Stream newStream = webResponse.GetResponseStream())
                {
                    if (newStream != null)
                    {
                        using (StreamReader reader = new StreamReader(newStream))
                        {
                            string result = reader.ReadToEnd();
                            return result;
                        }
                    }
                }
            }
            return null;
        }
        /// <summary>
        /// post 请求指定地址返回响应数据
        /// </summary>
        /// <param name="webRequest">请求</param>
        /// <param name="dicHeaders">请求头</param>
        /// <param name="requestBody">请求体</param>
        /// <returns>返回：响应信息</returns>
        private static HttpWebResponse PostRequest(HttpWebRequest webRequest, Dictionary<string, string> dicHeaders, string requestBody)
        {
            byte[] byteArray = Encoding.UTF8.GetBytes(requestBody);
            webRequest.ContentType = "application/json";
            webRequest.ContentLength = byteArray.Length;
            webRequest.Method = "POST";

            /// 请求头
            foreach (var key in dicHeaders.Keys)
            {
                webRequest.Headers.Add(key, dicHeaders[key]);
            }

            // 将参数写入流
            using (Stream newStream = webRequest.GetRequestStream())
            {
                newStream.Write(byteArray, 0, byteArray.Length);
                newStream.Close();
            }

            // 接收返回信息
            return (HttpWebResponse)webRequest.GetResponse();
        }
    }
}