发布一个HTTP接口

1.签名验证的工具类:

　　签名规则：

1. 将所有请求参数转成JSON字符串。
2. 将请求密钥分别添加到上述JSON字符串的头部和尾部，格式如下：

　　　　　　secret请求参数JSON字符串secret。

　　3. 对该字符串进行MD5（签名）运算，得到一个二进制数组。

　　4. 将该二进制数组转换为一个十六进制的字符串，该字符串是这些请求参数的签名。

/**
 * 请求参数签名工具类
 *
 */
public class ParamSignUtils {

    public static void main(String[] args) {
        HashMap<String, String> signMap = new HashMap<String, String>();
        String secret = "ywwXMYoWoS63u26fB1r4U";
        HashMap SignHashMap = ParamSignUtils.sign(signMap, secret);
        System.out.println("SignHashMap:" + SignHashMap);
        List<String> ignoreParamNames = new ArrayList<String>();
        ignoreParamNames.add("a");
        HashMap SignHashMap2 = ParamSignUtils.sign(signMap, ignoreParamNames, secret);
        System.out.println("SignHashMap2:" + SignHashMap2);
    }

    public static HashMap<String, String> sign(Map<String, String> paramValues, String secret) {
        return sign(paramValues, null, secret);
    }

    /**
     * @param paramValues
     * @param ignoreParamNames
     * @param secret
     * @return
     */
    public static HashMap<String, String> sign(Map<String, String> paramValues, List<String> ignoreParamNames,
            String secret) {
        try {
            HashMap<String, String> signMap = new HashMap<String, String>();
            StringBuilder sb = new StringBuilder();
            List<String> paramNames = new ArrayList<String>(paramValues.size());
            paramNames.addAll(paramValues.keySet());
            if (ignoreParamNames != null && ignoreParamNames.size() > 0) {
                for (String ignoreParamName : ignoreParamNames) {
                    paramNames.remove(ignoreParamName);
                }
            }
            Collections.sort(paramNames);
            sb.append(secret);
            for (String paramName : paramNames) {
                sb.append(paramName).append(paramValues.get(paramName));
            }
            sb.append(secret);
            byte[] md5Digest = getMD5Digest(sb.toString());
            String sign = byte2hex(md5Digest);
            signMap.put("appParam", sb.toString());
            signMap.put("appSign", sign);
            return signMap;
        } catch (IOException e) {
            throw new RuntimeException("加密签名计算错误", e);
        }

    }

    /**
     * @param paramValues
     * @param ignoreParamNames
     * @param secret
     * @return
     */
    public static HashMap<String, String> sign(String paramValues, String secret) {
        try {
            HashMap<String, String> signMap = new HashMap<String, String>();
            StringBuilder sb = new StringBuilder(secret);
            if(!StringUtils.isBlank(paramValues)){
                sb.append(paramValues);
            }
            sb.append(secret);
            byte[] md5Digest = getMD5Digest(sb.toString());
            String sign = byte2hex(md5Digest);
            signMap.put("appParam", sb.toString());
            signMap.put("appSign", sign);
            return signMap;
        } catch (IOException e) {
            throw new RuntimeException("加密签名计算错误", e);
        }

    }

    public static String utf8Encoding(String value, String sourceCharsetName) {
        try {
            return new String(value.getBytes(sourceCharsetName), "UTF-8");
        } catch (UnsupportedEncodingException e) {
            throw new IllegalArgumentException(e);
        }
    }

    private static byte[] getSHA1Digest(String data) throws IOException {
        byte[] bytes = null;
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-1");
            bytes = md.digest(data.getBytes("UTF-8"));
        } catch (GeneralSecurityException gse) {
            throw new IOException(gse);
        }
        return bytes;
    }

    private static byte[] getMD5Digest(String data) throws IOException {
        byte[] bytes = null;
        try {
            MessageDigest md = MessageDigest.getInstance("MD5");
            bytes = md.digest(data.getBytes("UTF-8"));
        } catch (GeneralSecurityException gse) {
            throw new IOException(gse);
        }
        return bytes;
    }

    private static String byte2hex(byte[] bytes) {
        StringBuilder sign = new StringBuilder();
        for (int i = 0; i < bytes.length; i++) {
            String hex = Integer.toHexString(bytes[i] & 0xFF);
            if (hex.length() == 1) {
                sign.append("0");
            }
            sign.append(hex.toUpperCase());
        }
        return sign.toString();
    }

}

2.获取HttpServletRequest的原生JSON参数

//获取请求JSON字符串
    private String getParams(HttpServletRequest req) {
        String result = null;
        try {
            // 包装request的输入流
            BufferedReader br = new BufferedReader(
            new InputStreamReader((ServletInputStream) req.getInputStream(), "utf-8"));
            // 缓冲字符
            StringBuffer sb = new StringBuffer("");
            String line;
            while ((line = br.readLine()) != null) {
                sb.append(line);
            }
            br.close();// 关闭缓冲流
            result = sb.toString();// 转换成字符
            System.out.println("result = " + result);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return result;
    }

3.接口的具体实现

@RequestMapping(value = "/getNoticeStockOutHeader", method = RequestMethod.POST)
    @ResponseBody
    public ResponseIntf getNoticeStockOutHeader(HttpServletRequest request, HttpServletResponse response) {
        response.setHeader("Access-Control-Allow-Origin", "*");// 跨域访问
        response.setCharacterEncoding("utf-8");
        ResponseIntf res = new ResponseIntf();
        try {
            request.setCharacterEncoding("utf-8");
            String json = this.getParams(request).replaceAll("\\s*", "");//去掉所有空格
            String sign = request.getHeader("sign");
            if(StringUtils.isBlank(sign)){
                throw new SecurityException("接口签名不能为空！");
            }
            if(!validateSign(json,sign)){
                throw new SecurityException("签名验证不通过！");
            }
            Gson gson = new Gson();
            RequestIntf req = gson.fromJson(json, RequestIntf.class);
            res.setResult(noticeStockOutService.getNoticeStockOutHeaderList(req));
            res.setSuccess(true);
            res.setMessage("调用成功");
        } catch (IllegalArgumentException e) {
            e.printStackTrace();
            logger.error(StringUtils.getStackTrace(e));
            res.setSuccess(false);
            res.setMessage("参数不合法！错误信息：" + e.getMessage());
        } catch (SecurityException e) {
            e.printStackTrace();
            logger.error(StringUtils.getStackTrace(e));
            res.setSuccess(false);
            res.setMessage("安全异常：" + e.getMessage());
        } catch (AppException e) {
            res.setSuccess(false);
            res.setMessage(e.getMessage());
        } catch (Exception e) {
            e.printStackTrace();
            logger.error(StringUtils.getStackTrace(e));
            res.setSuccess(false);
            res.setMessage("其它异常：" + e.getMessage());
        }
        return res;
    }

4.接口采用MD5加密，直接获取原生的JSON字符串近行加密，与存放在request的header中的sign进行比对，相等，则验证成功。