SpringBoot实现api加密的示例代码

1. 什么是API加密？

API加密是指对API访问时的数据进行加密处理，确保API的安全性，确保数据在传输过程中不被恶意篡改。

1. 实现API加密的原理

使用SpringBoot框架实现API加密，常用的加密算法有MD5和SHA1。

MD5加密算法可以用以下代码实现：

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class Md5Utils {

    public static String md5(String str) {
        try {
            MessageDigest md = MessageDigest.getInstance("MD5");
            md.update(str.getBytes());
            byte[] b = md.digest();
            int i;
            StringBuilder sb = new StringBuilder("");
            for (int offset = 0; offset < b.length; offset++) {
                i = b[offset];
                if (i < 0) {
                    i += 256;
                }
                if (i < 16) {
                    sb.append("0");
                }
                sb.append(Integer.toHexString(i));
            }
            return sb.toString();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
            return null;
        }
    }
}

SHA1的加密算法可以用以下代码实现：

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class Sha1Utils {

    public static String sha1(String str) {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-1");
            md.update(str.getBytes());
            byte[] b = md.digest();
            int i;
            StringBuilder sb = new StringBuilder("");
            for (byte aB : b) {
                i = aB;
                if (i < 0) {
                    i += 256;
                }
                if (i < 16) {
                    sb.append("0");
                }
                sb.append(Integer.toHexString(i));
            }
            return sb.toString();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
            return null;
        }
    }
}

1. SpringBoot如何实现API加密

SpringBoot集成了Filters和Interceptors，可以通过这两个技术实现API加密。

方法一：在Filter中解决API加密问题

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebFilter(filterName = "EncryptFilter", urlPatterns = "/api/*")
public class EncryptFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletResponse res = (HttpServletResponse) servletResponse;
        HttpServletRequest req = (HttpServletRequest) servletRequest;
        String url = req.getRequestURI();
        if (url.startsWith("/api/")) {
            // 对API请求数据进行加密处理
            filterChain.doFilter(new DecryptRequestWrapper(req), res);
            // 对API返回的数据进行解密处理
            res.getOutputStream().write(encryptRes(filterChain));
            return;
        }
        filterChain.doFilter(servletRequest, servletResponse);
    }

    @Override
    public void destroy() {

    }
}

方法二：在Interceptor中解决API加密问题

import net.sf.json.JSONObject;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

public class SignInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (checkAuth(request)) {
            return true;
        } else {
            // 返回错误信息
            response.setCharacterEncoding("UTF-8");
            response.setContentType("application/json; charset=utf-8");
            PrintWriter out = null;
            try {
                out = response.getWriter();
                JSONObject result = new JSONObject();
                result.put("success", false);
                result.put("status", 401);
                result.put("message", "签名校验失败");
                out.append(result.toString());
            } catch (IOException e) {
                e.printStackTrace();
                response.sendError(500);
                return false;
            } finally {
                if (out != null) {
                    out.close();
                }
            }
            return false;
        }
    }

    private boolean checkAuth(HttpServletRequest request) {
        // TODO: 检查是否合法
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {

    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {

    }
}

1. SpringBoot API加密的示例代码

（1）使用Filter实现SpringBoot API加密

@RestController
@RequestMapping("/api")
public class ApiController {

    @PostMapping("/encrypt")
    public Object encrypt(String param) {
        // 对请求参数进行加密处理 
        String encrypt = Md5Utils.md5(param);
        JSONObject jsonObject = new JSONObject();
        jsonObject.put("success", true);
        jsonObject.put("data", encrypt);
        return jsonObject;
    }
}

（2）使用Interceptor实现SpringBoot API加密

@RestController
@RequestMapping("/api")
public class ApiController {

    @Autowired
    private UserService userService;

    @PostMapping("/register")
    public Object register(@RequestParam String mobile, @RequestParam String password) {
        User user = new User();
        user.setMobile(mobile);
        user.setPassword(password);
        userService.addUser(user);

        JSONObject jsonObject = new JSONObject();
        jsonObject.put("success", true);
        return jsonObject;
    }

    @PostMapping("/login")
    public Object login(@RequestParam String mobile, @RequestParam String password) {
        User user = userService.findUser(mobile);

        if (user != null && user.getPassword().equals(password)) {
            JSONObject jsonObject = new JSONObject();
            jsonObject.put("success", true);
            return jsonObject;
        } else {
            JSONObject jsonObject = new JSONObject();
            jsonObject.put("success", false);
            jsonObject.put("message", "用户名或密码错误");
            return jsonObject;
        }
    }
}