Gateway API接口安全设计（加密 、签名） - 图1

1 防止数据抓包窃取

1.1 风险简述

简述：当用户登录时，恶意攻击者可以用抓包工具可以拿到用户提交的表单信息，可以获取用户的账号密码，进而可以恶意访问网站。
Gateway API接口安全设计（加密 、签名） - 图2

1.2 RSA 非对称加密

1.2.1 RSA简介

RSA加密算法是一种非对称加密算法。在公开密钥加密和电子商业中RSA被广泛使用。RSA是1977年由罗纳德·李维斯特（Ron Rivest）、阿迪·萨莫尔（Adi Shamir）和伦纳德·阿德曼（Leonard Adleman）一起提出的。当时他们三人都在麻省理工学院工作。RSA就是他们三人姓氏开头字母拼在一起组成的。
1973年，在英国政府通讯总部工作的数学家克利福德·柯克斯（Clifford Cocks）在一个内部文件中提出了一个相同的算法，但他的发现被列入机密，一直到1997年才被发表。对极大整数做因数分解的难度决定了RSA算法的可靠性。换言之，对一极大整数做因数分解愈困难，RSA算法愈可靠。
假如有人找到一种快速因数分解的算法的话，那么用RSA加密的信息的可靠性就肯定会极度下降。但找到这样的算法的可能性是非常小的。今天只有短的RSA钥匙才可能被强力方式解破。到目前为止，世界上还没有任何可靠的攻击RSA算法的方式。只要其钥匙的长度足够长，用RSA加密的信息实际上是不能被解破的。
1983年麻省理工学院在美国为RSA算法申请了专利。这个专利2000年9月21日失效。由于该算法在申请专利前就已经被发表了，在世界上大多数其它地区这个专利权不被承认。

1.2.2 RSA应用过程

非对称算法的在应用的过程如下:

  • 接收方生成公钥和私钥，公钥公开，私钥保留；
  • 发送方将要发送的消息采用公钥加密，得到密文，然后将密文发送给接收方；
  • 接收方收到密文后，用自己的私钥进行解密，获得明文。
    1.2.3 RSA工具类


    ```java import com.demo.excepiton.RsaException; import lombok.extern.slf4j.Slf4j; import org.apache.commons.codec.binary.Base64;

import javax.crypto.Cipher; import java.nio.charset.StandardCharsets; import java.security.KeyFactory; import java.security.KeyPair; import java.security.KeyPairGenerator; import java.security.SecureRandom; import java.security.interfaces.RSAPrivateKey; import java.security.interfaces.RSAPublicKey; import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.X509EncodedKeySpec; import java.util.HashMap; import java.util.Map;

@Slf4j public class RSAUtils {

  1. public static final String PUBLIC_KEY = "public_key";
  3. public static final String PRIVATE_KEY = "private_key";
  6. public static Map<String, String> generateRasKey() {
  7.     Map<String, String> rs = new HashMap<>();
  8.     try {
  9.         // KeyPairGenerator类用于生成公钥和私钥对，基于RSA算法生成对象
  10.         KeyPairGenerator keyPairGen = null;
  11.         keyPairGen = KeyPairGenerator.getInstance("RSA");
  12.         keyPairGen.initialize(1024, new SecureRandom());
  13.         // 生成一个密钥对，保存在keyPair中
  14.         KeyPair keyPair = keyPairGen.generateKeyPair();
  15.         // 得到私钥 公钥
  16.         RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
  17.         RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
  18.         String publicKeyString = new String(Base64.encodeBase64(publicKey.getEncoded()));
  19.         // 得到私钥字符串
  20.         String privateKeyString = new String(Base64.encodeBase64((privateKey.getEncoded())));
  21.         // 将公钥和私钥保存到Map
  22.         rs.put(PUBLIC_KEY, publicKeyString);
  23.         rs.put(PRIVATE_KEY, privateKeyString);
  24.     } catch (Exception e) {
  25.         log.error("RsaUtils invoke genKeyPair failed.", e);
  26.         throw new RsaException("RsaUtils invoke genKeyPair failed.");
  27.     }
  28.     return rs;
  29. }
  32. public static String encrypt(String str, String publicKey) {
  33.     try {
  34.         //base64编码的公钥
  35.         byte[] decoded = Base64.decodeBase64(publicKey);
  36.         RSAPublicKey pubKey = (RSAPublicKey) KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(decoded));
  37.         //RSA加密
  38.         Cipher cipher = Cipher.getInstance("RSA");
  39.         cipher.init(Cipher.ENCRYPT_MODE, pubKey);
  40.         return Base64.encodeBase64String(cipher.doFinal(str.getBytes(StandardCharsets.UTF_8)));
  41.     } catch (Exception e) {
  42.         log.error("RsaUtils invoke encrypt failed.", e);
  43.         throw new RsaException("RsaUtils invoke encrypt failed.");
  44.     }
  45. }
  48. public static String decrypt(String str, String privateKey) {
  50.     try {
  51.         //64位解码加密后的字符串
  52.         byte[] inputByte = Base64.decodeBase64(str.getBytes(StandardCharsets.UTF_8));
  53.         //base64编码的私钥
  54.         byte[] decoded = Base64.decodeBase64(privateKey);
  55.         RSAPrivateKey priKey = (RSAPrivateKey) KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(decoded));
  56.         //RSA解密
  57.         Cipher cipher = Cipher.getInstance("RSA");
  58.         cipher.init(Cipher.DECRYPT_MODE, priKey);
  59.         return new String(cipher.doFinal(inputByte));
  60.     } catch (Exception e) {
  61.         log.error("RsaUtils invoke decrypt failed.", e);
  62.         throw new RsaException("RsaUtils invoke decrypt failed.");
  63.     }
  65. }

}

  1. <a name="FRFlg"></a>
  2. ##### <br /><br />
  3. RsaException: 是自定义异常。
  4. ```java
  5. @Getter
  6. public class RsaException extends RuntimeException {
  8.     private final String message;
  10.     public RsaException(String message) {
  11.         this.message = message;
  12.     }
  14. }

1.2.4 UNIT TEST单元测试


  1. import com.alibaba.fastjson.JSONObject;
  2. import com.demo.utils.RSAUtils;
  3. import org.junit.Test;
  5. import java.util.Map;
  8. /**
  9.  * @Description:
  10.  * @Author: rosh
  11.  * @Date: 2021/10/25 22:30
  12.  */
  13. public class RsaTest {
  15.     /**
  16.      *  用测试生成的公钥，私钥赋值
  17.      */
  18.     private static final String PUBLIC_KEY = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFtTlL61IqIGd+fRLUhJ0MjsqFXFJswCohJ45m51WvbxDPRP3gllW0WChk74D5JEOpMDSWo4C7RfoGlBRNW7kQ6qYGukYZ5jgYpzoT0+gp3on96fQXEyQJysv9xiTPIdmSXXVVj1HAOJw29RbzxIVKUSzzPXvEtXRTtCC1+wkAJQIDAQAB";
  20.     private static final String PRIVATE_KEY = "MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAIW1OUvrUiogZ359EtSEnQyOyoVcUmzAKiEnjmbnVa9vEM9E/eCWVbRYKGTvgPkkQ6kwNJajgLtF+gaUFE1buRDqpga6RhnmOBinOhPT6Cneif3p9BcTJAnKy/3GJM8h2ZJddVWPUcA4nDb1FvPEhUpRLPM9e8S1dFO0ILX7CQAlAgMBAAECgYBC4amtbiKFa/wY61tV7pfYRjzLhKi+OUlZmD3E/4Z+4KGZ7DrJ8qkgMtDR3HO5LAikQrare1HTW2d7juqw32ascu+uDObf4yrYNKin+ZDLUYvIDfLhThPxnZJwQ/trdtfxO3VM//XbwZacmwYbAsYW/3QPUXwwOPAgbC2oth8kqQJBANKLyXcdjZx4cwJVl7xNeC847su8y6bPpcBASsaQloCIPiNBIg1h76dpfEGIQBYWJWbBsxtHe/MhOmz7fNFDS2sCQQCiktYZR0dZNH4eNX329LoRuBiltpr9tf36rVOlKr1GSHkLYEHF2qtyXV2mdrY8ZWpvuo3qm1oSLaqmop2rN9avAkBHk85B+IIUF77BpGeZVJzvMOO9z8lMRHuNCE5jgvQnbinxwkrZUdovh+T+QlvHJnBApslFFOBGn51FP5oHamFRAkEAmwZmPsinkrrpoKjlqz6GyCrC5hKRDWoj/IyXfKKaxpCJTH3HeoIghvfdO8Vr1X/n1Q8SESt+4mLFngznSMQAZQJBAJx07bCFYbA2IocfFV5LTEYTIiUeKdue2NP2yWqZ/+tB5H7jNwQTJmX1mn0W/sZm4+nJM7SjfETpNZhH49+rV6U=";
  23.     /**
  24.      *  生成公钥私钥
  25.      */
  26.     @Test
  27.     public void generateRsaKey() {
  28.         Map<String, String> map = RSAUtils.generateRasKey();
  29.         System.out.println("随机生成的公钥为:" + map.get(RSAUtils.PUBLIC_KEY));
  30.         System.out.println("随机生成的私钥为:" + map.get(RSAUtils.PRIVATE_KEY));
  32.     }
  34.     /**
  35.      * 加密: Yeidauky/iN1/whevov2+ntzXJKAp2AHfESu5ixnDqH5iB7ww+TcfqJpDfkPHfb12Y0sVXw0gBHNJ4inkh7l2/SJBze3pKQU/mg3oyDokTia3JZIs+e80/iJcSfN+yA1JaqY+eJPYiBiOGAF2S6x0ynvJg/Wj0fwp2Tq3PDzRMo=
  36.      */
  37.     @Test
  38.     public void testEncrypt() {
  39.         JSONObject jsonObject = new JSONObject();
  40.         jsonObject.put("username", "rosh");
  41.         jsonObject.put("password", "123456");
  42.         String str = jsonObject.toJSONString();
  43.         String encrypt = RSAUtils.encrypt(str, PUBLIC_KEY);
  44.         System.out.println(encrypt);
  45.     }
  47.     @Test
  48.     public void testDecrypt() {
  50.         String decrypt = RSAUtils.decrypt("Yeidauky/iN1/whevov2+ntzXJKAp2AHfESu5ixnDqH5iB7ww+TcfqJpDfkPHfb12Y0sVXw0gBHNJ4inkh7l2/SJBze3pKQU/mg3oyDokTia3JZIs+e80/iJcSfN+yA1JaqY+eJPYiBiOGAF2S6x0ynvJg/Wj0fwp2Tq3PDzRMo=",
  51.                 PRIVATE_KEY);
  53.         System.out.println(decrypt);
  54.     }
  57. }



Gateway API接口安全设计（加密 、签名） - 图3

1.3 案例

SpringCloud Gateway + SpringBoot + Nacos+redis
Gateway API接口安全设计（加密 、签名） - 图4
Gateway API接口安全设计（加密 、签名） - 图5

1.3.1 前端登录代码

后端把公钥跟前端约定好：

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>登录页面</title>
  7. </head>
  8. <body>
  10. <h1>登录</h1>
  13. <from id="from">
  14.     账号：<input id="username" type="text"/>
  15.     <br/>
  16.     密码：<input id="password" type="password"/>
  17.     <br/>
  18.     <input id="btn_login" type="button" value="登录"/>
  19. </from>
  23. <script src="js/jquery.min.js"></script>
  24. <script src="js/jsencrypt.js"></script>
  27. <script type="text/javascript">
  28.     var encrypt = new JSEncrypt();
  29.     encrypt.setPublicKey("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFtTlL61IqIGd+fRLUhJ0MjsqFXFJswCohJ45m51WvbxDPRP3gllW0WChk74D5JEOpMDSWo4C7RfoGlBRNW7kQ6qYGukYZ5jgYpzoT0+gp3on96fQXEyQJysv9xiTPIdmSXXVVj1HAOJw29RbzxIVKUSzzPXvEtXRTtCC1+wkAJQIDAQAB");
  30.     $("#btn_login").click(function () {
  31.         const username = $("#username").val();
  32.         const password = $("#password").val();
  33.         const form = {};
  34.         form.username = username;
  35.         form.password = password;
  36.         $.ajax({
  37.             url: "http://localhost:9000/api/user/login",
  38.             data: encrypt.encrypt(JSON.stringify(form)),
  39.             type: "POST",
  40.             dataType: "json",
  41.             contentType: "application/json;charset=utf-8",
  42.             success: function (data) {
  43.                 console.log(data);
  44.             }
  45.         });
  46.     })
  47. </script>
  50. </body>
  51. </html>

1.3.2 前端查询代码

设定公钥、token，token是登录成功后返回的值

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>查询测试</title>
  6. </head>
  7. <body>
  10. id：<input id="id_txt" type="text"/>
  11. <input id="btn_search" type="button" value="查询"/>
  14. <script src="js/jquery.min.js"></script>
  15. <script src="js/jsencrypt.js"></script>
  16. <script type="text/javascript">
  17.     var encrypt = new JSEncrypt();
  18.     encrypt.setPublicKey("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFtTlL61IqIGd+fRLUhJ0MjsqFXFJswCohJ45m51WvbxDPRP3gllW0WChk74D5JEOpMDSWo4C7RfoGlBRNW7kQ6qYGukYZ5jgYpzoT0+gp3on96fQXEyQJysv9xiTPIdmSXXVVj1HAOJw29RbzxIVKUSzzPXvEtXRTtCC1+wkAJQIDAQAB");
  20.     $("#btn_search").click(function () {
  21.         const id = $("#id_txt").val();
  22.         const param = "id=" + id + "&requestId=" + getUuid();
  23.         encrypt.encrypt(param);
  24.         const url = "http://localhost:9000/api/user/detail?param=" + encrypt.encrypt(param);
  25.         $.ajax({
  26.             url: url,
  27.             beforeSend: function (XMLHttpRequest) {
  28.                 XMLHttpRequest.setRequestHeader("token", "eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIzYzE1ODczYS1iMGUxLTQyNzctYTRjOS1kYTMwNjdiYmE0NWIiLCJpYXQiOjE2MzUzMDYwMDAsInN1YiI6IntcInBhc3N3b3JkXCI6XCIxMjM0NTZcIixcInVzZXJJZFwiOjEsXCJ1c2VybmFtZVwiOlwiYWRtaW5cIn0iLCJleHAiOjE2MzU1NjUyMDB9.fIQi_cV2ZMszBVFV4GoIpGhCSENQKrDi8DsbArk7mGk");
  29.             },
  30.             type: "GET",
  31.             success: function (data) {
  32.                 console.log(data);
  33.             }
  34.         });
  35.     });
  38.     function getUuid() {
  39.         var s = [];
  40.         var hexDigits = "0123456789abcdef";
  41.         for (var i = 0; i < 32; i++) {
  42.             s[i] = hexDigits.substr(Math.floor(Math.random() * 0x10), 1);
  43.         }
  44.         s[14] = "4"; // bits 12-15 of the time_hi_and_version field to 0010
  45.         s[19] = hexDigits.substr((s[19] & 0x3) | 0x8, 1); // bits 6-7 of the clock_seq_hi_and_reserved to 01
  46.         s[8] = s[13] = s[18] = s[23];
  47.         var uuid = s.join("");
  48.         return uuid;
  49.     }
  51. </script>
  54. </body>
  55. </html>

1.3.3 GatewayFilterConfig

解密前端传来的参数并修改传参

  1. import com.demo.constant.UserConstant;
  2. import com.demo.excepiton.RSAException;
  3. import com.demo.utils.RSAUtils;
  4. import com.demo.utils.TokenUtils;
  5. import io.jsonwebtoken.Claims;
  6. import org.apache.commons.lang3.StringUtils;
  7. import org.springframework.cloud.gateway.filter.GatewayFilterChain;
  8. import org.springframework.cloud.gateway.filter.GlobalFilter;
  9. import org.springframework.cloud.gateway.filter.factory.rewrite.CachedBodyOutputMessage;
  10. import org.springframework.cloud.gateway.support.BodyInserterContext;
  11. import org.springframework.context.annotation.Configuration;
  12. import org.springframework.core.Ordered;
  13. import org.springframework.core.io.buffer.DataBuffer;
  14. import org.springframework.http.HttpHeaders;
  15. import org.springframework.http.ReactiveHttpOutputMessage;
  16. import org.springframework.http.server.reactive.ServerHttpRequest;
  17. import org.springframework.http.server.reactive.ServerHttpRequestDecorator;
  18. import org.springframework.stereotype.Component;
  19. import org.springframework.util.AntPathMatcher;
  20. import org.springframework.web.reactive.function.BodyInserter;
  21. import org.springframework.web.reactive.function.BodyInserters;
  22. import org.springframework.web.reactive.function.server.HandlerStrategies;
  23. import org.springframework.web.reactive.function.server.ServerRequest;
  24. import org.springframework.web.server.ServerWebExchange;
  25. import reactor.core.publisher.Flux;
  26. import reactor.core.publisher.Mono;
  28. import java.lang.reflect.Field;
  29. import java.net.URI;
  32. /**
  33.  * @Description:
  34.  * @Author: rosh
  35.  * @Date: 2021/10/26 22:24
  36.  */
  37. @Configuration
  38. @Component
  39. public class GatewayFilterConfig implements GlobalFilter, Ordered {
  42.     @Override
  43.     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
  44.         //1 如果是登录不校验Token
  45.         String requestUrl = exchange.getRequest().getPath().value();
  46.         AntPathMatcher pathMatcher = new AntPathMatcher();
  47.         if (!pathMatcher.match("/user/login", requestUrl)) {
  48.             String token = exchange.getRequest().getHeaders().getFirst(UserConstant.TOKEN);
  49.             Claims claim = TokenUtils.getClaim(token);
  50.             if (StringUtils.isBlank(token) || claim == null) {
  51.                 return FilterUtils.invalidToken(exchange);
  52.             }
  53.         }
  54.         //2 修改请求参数,并获取请求参数
  55.         try {
  56.             updateRequestParam(exchange);
  57.         } catch (Exception e) {
  58.             return FilterUtils.invalidUrl(exchange);
  59.         }
  60.         //3 获取请求体,修改请求体
  61.         ServerRequest serverRequest = ServerRequest.create(exchange, HandlerStrategies.withDefaults().messageReaders());
  62.         Mono<String> modifiedBody = serverRequest.bodyToMono(String.class).flatMap(body -> {
  63.             String encrypt = RSAUtils.decrypt(body, RSAConstant.PRIVATE_KEY);
  64.             return Mono.just(encrypt);
  65.         });
  67.         //创建BodyInserter修改请求体
  68.         BodyInserter<Mono<String>, ReactiveHttpOutputMessage> bodyInserter = BodyInserters.fromPublisher(modifiedBody, String.class);
  69.         HttpHeaders headers = new HttpHeaders();
  70.         headers.putAll(exchange.getRequest().getHeaders());
  71.         headers.remove(HttpHeaders.CONTENT_LENGTH);
  72.         //创建CachedBodyOutputMessage并且把请求param加入
  73.         CachedBodyOutputMessage outputMessage = new CachedBodyOutputMessage(exchange, headers);
  74.         return bodyInserter.insert(outputMessage, new BodyInserterContext()).then(Mono.defer(() -> {
  75.             ServerHttpRequestDecorator decorator = new ServerHttpRequestDecorator(exchange.getRequest()) {
  76.                 @Override
  77.                 public Flux<DataBuffer> getBody() {
  78.                     return outputMessage.getBody();
  79.                 }
  80.             };
  81.             return chain.filter(exchange.mutate().request(decorator).build());
  82.         }));
  84.     }
  86.     /**
  87.      * 修改前端传的参数
  88.      */
  89.     private void updateRequestParam(ServerWebExchange exchange) throws NoSuchFieldException, IllegalAccessException {
  90.         ServerHttpRequest request = exchange.getRequest();
  91.         URI uri = request.getURI();
  92.         String query = uri.getQuery();
  93.         if (StringUtils.isNotBlank(query) && query.contains("param")) {
  94.             String[] split = query.split("=");
  95.             String param = RSAUtils.decrypt(split[1], RSAConstant.PRIVATE_KEY);
  96.             Field targetQuery = uri.getClass().getDeclaredField("query");
  97.             targetQuery.setAccessible(true);
  98.             targetQuery.set(uri, param);
  99.         }
  100.     }
  103.     @Override
  104.     public int getOrder() {
  105.         return 80;
  106.     }
  107. }

1.3.4 GateWay 统一异常
  1. public abstract class AbstractExceptionHandler {
  2.     protected JSONObject buildErrorMap(Throwable ex) {
  3.         JSONObject json = new JSONObject();
  4.         if (ex instanceof RSAException || ex instanceof IllegalArgumentException) {
  5.             json.put("code", HttpStatus.BAD_REQUEST.value());
  6.             if (StringUtils.isNotBlank(ex.getMessage())){
  7.                 json.put("msg", ex.getMessage());
  8.             }else {
  9.                 json.put("msg", "无效的请求");
  10.             }
  12.         } else {
  13.             json.put("code", HttpStatus.BAD_REQUEST.value());
  14.             json.put("msg", "未知错误联系管理员");
  15.         }
  16.         return json;
  17.     }
  19. }
  1. @Configuration
  2. public class GatewayExceptionConfig {
  4.     @Primary
  5.     @Bean
  6.     @Order(Ordered.HIGHEST_PRECEDENCE)
  7.     public ErrorWebExceptionHandler errorWebExceptionHandler(ObjectProvider<List<ViewResolver>> viewResolversProvider,
  8.                                                              ServerCodecConfigurer serverCodecConfigurer) {
  9.         GatewayExceptionHandler gatewayExceptionHandler = new GatewayExceptionHandler();
  10.         gatewayExceptionHandler.setViewResolvers(viewResolversProvider.getIfAvailable(Collections::emptyList));
  11.         gatewayExceptionHandler.setMessageWriters(serverCodecConfigurer.getWriters());
  12.         gatewayExceptionHandler.setMessageReaders(serverCodecConfigurer.getReaders());
  13.         return gatewayExceptionHandler;
  14.     }
  15. }
  1. import com.alibaba.fastjson.JSONObject;
  2. import lombok.extern.slf4j.Slf4j;
  3. import org.springframework.boot.web.reactive.error.ErrorWebExceptionHandler;
  4. import org.springframework.http.HttpStatus;
  5. import org.springframework.http.MediaType;
  6. import org.springframework.http.codec.HttpMessageReader;
  7. import org.springframework.http.codec.HttpMessageWriter;
  8. import org.springframework.util.Assert;
  9. import org.springframework.web.reactive.function.BodyInserters;
  10. import org.springframework.web.reactive.function.server.RequestPredicates;
  11. import org.springframework.web.reactive.function.server.RouterFunctions;
  12. import org.springframework.web.reactive.function.server.ServerRequest;
  13. import org.springframework.web.reactive.function.server.ServerResponse;
  14. import org.springframework.web.reactive.result.view.ViewResolver;
  15. import org.springframework.web.server.ServerWebExchange;
  16. import reactor.core.publisher.Mono;
  18. import java.util.Collections;
  19. import java.util.List;
  20. import java.util.Map;
  23. @Slf4j
  24. public class GatewayExceptionHandler extends AbstractExceptionHandler implements ErrorWebExceptionHandler {
  27.     private List<HttpMessageReader<?>> messageReaders = Collections.emptyList();
  30.     private List<HttpMessageWriter<?>> messageWriters = Collections.emptyList();
  33.     private List<ViewResolver> viewResolvers = Collections.emptyList();
  36.     private ThreadLocal<JSONObject> exceptionHandlerResult = new ThreadLocal<>();
  39.     public void setMessageReaders(List<HttpMessageReader<?>> messageReaders) {
  40.         Assert.notNull(messageReaders, "'messageReaders' must not be null");
  41.         this.messageReaders = messageReaders;
  42.     }
  45.     public void setViewResolvers(List<ViewResolver> viewResolvers) {
  46.         this.viewResolvers = viewResolvers;
  47.     }
  50.     public void setMessageWriters(List<HttpMessageWriter<?>> messageWriters) {
  51.         Assert.notNull(messageWriters, "'messageWriters' must not be null");
  52.         this.messageWriters = messageWriters;
  53.     }
  55.     @Override
  56.     public Mono<Void> handle(ServerWebExchange exchange, Throwable ex) {
  57.         JSONObject errorInfo = super.buildErrorMap(ex);
  58.         if (exchange.getResponse().isCommitted()) {
  59.             return Mono.error(ex);
  60.         }
  61.         exceptionHandlerResult.set(errorInfo);
  62.         ServerRequest newRequest = ServerRequest.create(exchange, this.messageReaders);
  63.         return RouterFunctions.route(RequestPredicates.all(), this::renderErrorResponse).route(newRequest)
  64.                 .switchIfEmpty(Mono.error(ex))
  65.                 .flatMap(handler -> handler.handle(newRequest))
  66.                 .flatMap(response -> write(exchange, response));
  68.     }
  71.     protected Mono<ServerResponse> renderErrorResponse(ServerRequest request) {
  72.         Map<String, Object> result = exceptionHandlerResult.get();
  73.         return ServerResponse.status(HttpStatus.OK)
  74.                 .contentType(MediaType.APPLICATION_JSON)
  75.                 .body(BodyInserters.fromValue(result));
  76.     }
  79.     private Mono<? extends Void> write(ServerWebExchange exchange,
  80.                                        ServerResponse response) {
  81.         exchange.getResponse().getHeaders().setContentType(response.headers().getContentType());
  82.         return response.writeTo(exchange, new ResponseContext());
  83.     }


  1.  private class ResponseContext implements ServerResponse.Context {
  3.         @Override
  4.         public List<HttpMessageWriter<?>> messageWriters() {
  5.             return GatewayExceptionHandler.this.messageWriters;
  6.         }
  8.         @Override
  9.         public List<ViewResolver> viewResolvers() {
  10.             return GatewayExceptionHandler.this.viewResolvers;
  11.         }
  12.     }
  13. }

1.3.5 JAVA业务代码
  1. @RestController
  2. @RequestMapping("/user")
  3. public class UserController {
  6.     @Autowired
  7.     private UserService userService;
  9.     @PostMapping("/login")
  10.     public String login(@RequestBody UserForm userForm) {
  12.         return userService.login(userForm);
  13.     }
  15.     @GetMapping("/detail")
  16.     public JSONObject detail(@RequestParam("id") Long id) {
  18.         return userService.detail(id);
  19.     }
  20. }
  1. @Service
  2. public class UserService {
  5.     private static final String USERNAME = "admin";
  7.     private static final String PASSWORD = "123456";
  9.     private static final Long USER_ID = 1L;
  12.     /**
  13.      * 模拟 登录 username = admin, password =123456,user_id 1L 登录成功 返回token
  14.      */
  15.     public String login(UserForm userForm) {
  17.         String username = userForm.getUsername();
  18.         String password = userForm.getPassword();
  20.         if (USERNAME.equals(username) && PASSWORD.equals(password)) {
  21.             JSONObject userInfo = new JSONObject();
  22.             userInfo.put("username", USERNAME);
  23.             userInfo.put("password", PASSWORD);
  24.             userInfo.put("userId", USER_ID);
  25.             return TokenUtils.createToken(userInfo.toJSONString());
  26.         }
  28.         return "账号密码不正确";
  29.     }
  32.     public JSONObject detail(Long id) {
  33.         JSONObject jsonObject = new JSONObject();
  34.         jsonObject.put("id", id);
  35.         jsonObject.put("name", "admin");
  36.         return jsonObject;
  37.     }
  38. }

1.3.6 测试

登录：返回token
Gateway API接口安全设计（加密 、签名） - 图6
Gateway API接口安全设计（加密 、签名） - 图7
查询：
Gateway API接口安全设计（加密 、签名） - 图8

2 设置URL有效时长

为了增强URL安全性，前端在header中添加时间戳。

2.1 前端代码

在header中添加时间戳
Gateway API接口安全设计（加密 、签名） - 图9

2.2 后端验证时间戳

Gateway API接口安全设计（加密 、签名） - 图10

  1. private Long getDateTimestamp(HttpHeaders httpHeaders) {
  2.         List<String> list = httpHeaders.get("timestamp");
  3.         if (CollectionUtils.isEmpty(list)) {
  4.             throw new IllegalArgumentException("拒绝服务");
  5.         }
  6.         long timestamp = Long.parseLong(list.get(0));
  7.         long currentTimeMillis = System.currentTimeMillis();
  8.         //有效时长为5分钟
  9.         if (currentTimeMillis - timestamp > 1000 * 60 * 5) {
  10.             throw new IllegalArgumentException("拒绝服务");
  11.         }
  12.         return timestamp;
  13.     }

2.3 测试不传时间戳

Gateway API接口安全设计（加密 、签名） - 图11

3 确保URL唯一性

确保URL唯一性，前端请求中增加UUID，后端存入redis，有效时长为5分钟，5分钟重复提交拒绝服务

3.1 修改前端请求参数

Gateway API接口安全设计（加密 、签名） - 图12

3.2 后端增加验证RequestId

Gateway API接口安全设计（加密 、签名） - 图13

  1. private String getRequestId(HttpHeaders headers) {
  2.         List<String> list = headers.get("requestId");
  3.         if (CollectionUtils.isEmpty(list)) {
  4.             throw new IllegalArgumentException(ERROR_MESSAGE);
  5.         }
  6.         String requestId = list.get(0);
  7.         //如果requestId存在redis中直接返回
  8.         String temp = redisTemplate.opsForValue().get(requestId);
  9.         if (StringUtils.isNotBlank(temp)) {
  10.             throw new IllegalArgumentException(ERROR_MESSAGE);
  11.         }
  12.         redisTemplate.opsForValue().set(requestId, requestId, 5, TimeUnit.MINUTES);
  13.         return requestId;
  14.     }

4 增加签名

最后一步，添加签名

4.1 前端增加签名

跟前端约定好，json数据按照ASCII升序排序。
登录页面：

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>登录页面</title>
  7. </head>
  8. <body>
  10. <h1>登录</h1>
  13. <from id="from">
  14.     账号：<input id="username" type="text"/>
  15.     <br/>
  16.     密码：<input id="password" type="password"/>
  17.     <br/>
  18.     <input id="btn_login" type="button" value="登录"/>
  19. </from>
  24. <script src="js/jquery.min.js"></script>
  25. <script src="js/jsencrypt.js"></script>
  26. <script src="js/md5.min.js"></script>
  28. <script type="text/javascript">
  29.     var encrypt = new JSEncrypt();
  30.     encrypt.setPublicKey("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFtTlL61IqIGd+fRLUhJ0MjsqFXFJswCohJ45m51WvbxDPRP3gllW0WChk74D5JEOpMDSWo4C7RfoGlBRNW7kQ6qYGukYZ5jgYpzoT0+gp3on96fQXEyQJysv9xiTPIdmSXXVVj1HAOJw29RbzxIVKUSzzPXvEtXRTtCC1+wkAJQIDAQAB");
  31.     $("#btn_login").click(function () {
  32.         //表单
  33.         const username = $("#username").val();
  34.         const password = $("#password").val();
  35.         const form = {};
  36.         form.username = username;
  37.         form.password = password;
  38.         //生成签名，也可以加盐
  39.         const timestamp = Date.parse(new Date());
  40.         const data = JSON.stringify(sort_ASCII(form));
  41.         const requestId = getUuid();
  42.         const sign = MD5(data + requestId + timestamp);
  45.         $.ajax({
  46.             url: "http://localhost:9000/api/user/login",
  47.             beforeSend: function (XMLHttpRequest) {
  48.                 XMLHttpRequest.setRequestHeader("timestamp", timestamp);
  49.                 XMLHttpRequest.setRequestHeader("requestId", requestId);
  50.                 XMLHttpRequest.setRequestHeader("sign", sign);
  51.             },
  52.             data: encrypt.encrypt(data),
  53.             type: "POST",
  54.             dataType: "json",
  55.             contentType: "application/json;charset=utf-8",
  56.             success: function (data) {
  57.                 console.log(data);
  58.             }
  59.         });
  60.     });
  63.     function getUuid() {
  64.         var s = [];
  65.         var hexDigits = "0123456789abcdef";
  66.         for (var i = 0; i < 32; i++) {
  67.             s[i] = hexDigits.substr(Math.floor(Math.random() * 0x10), 1);
  68.         }
  69.         s[14] = "4"; // bits 12-15 of the time_hi_and_version field to 0010
  70.         s[19] = hexDigits.substr((s[19] & 0x3) | 0x8, 1); // bits 6-7 of the clock_seq_hi_and_reserved to 01
  71.         s[8] = s[13] = s[18] = s[23];
  72.         var uuid = s.join("");
  73.         return uuid;
  74.     }
  76.     function sort_ASCII(obj) {
  77.         var arr = new Array();
  78.         var num = 0;
  79.         for (var i in obj) {
  80.             arr[num] = i;
  81.             num++;
  82.         }
  83.         var sortArr = arr.sort();
  84.         var sortObj = {};
  85.         for (var i in sortArr) {
  86.             sortObj[sortArr[i]] = obj[sortArr[i]];
  87.         }
  88.         return sortObj;
  89.     }
  91. </script>
  94. </body>
  95. </html>

4.2 增强读取Body类

  1. /**
  2.  * @Description:
  3.  * @Author: Rosh
  4.  * @Date: 2021/10/27 11:03
  5.  */
  6. public class MyCachedBodyOutputMessage extends CachedBodyOutputMessage {
  8.     private Map<String, Object> paramMap;
  10.     private Long dateTimestamp;
  12.     private String requestId;
  14.     private String sign;
  16.     public MyCachedBodyOutputMessage(ServerWebExchange exchange, HttpHeaders httpHeaders) {
  17.         super(exchange, httpHeaders);
  18.     }
  20.     public void initial(Map<String, Object> paramMap, String requestId, String sign, Long dateTimestamp) {
  21.         this.paramMap = paramMap;
  22.         this.requestId = requestId;
  23.         this.sign = sign;
  24.         this.dateTimestamp = dateTimestamp;
  25.     }
  28.     public Map<String, Object> getParamMap() {
  29.         return paramMap;
  30.     }
  32.     public Long getDateTimestamp() {
  33.         return dateTimestamp;
  34.     }
  36.     public String getRequestId() {
  37.         return requestId;
  38.     }
  40.     public String getSign() {
  41.         return sign;
  42.     }
  43. }

4.3 修改GatewayFilterConfig


  1. import com.alibaba.fastjson.JSON;
  2. import com.alibaba.fastjson.JSONObject;
  3. import com.alibaba.nacos.common.utils.Md5Utils;
  4. import com.demo.constant.UserConstant;
  5. import com.demo.gateway.pojo.MyCachedBodyOutputMessage;
  6. import com.demo.utils.RSAUtils;
  7. import com.demo.utils.TokenUtils;
  8. import io.jsonwebtoken.Claims;
  9. import org.apache.commons.lang3.StringUtils;
  10. import org.springframework.beans.factory.annotation.Autowired;
  11. import org.springframework.cloud.gateway.filter.GatewayFilterChain;
  12. import org.springframework.cloud.gateway.filter.GlobalFilter;
  13. import org.springframework.cloud.gateway.support.BodyInserterContext;
  14. import org.springframework.context.annotation.Configuration;
  15. import org.springframework.core.Ordered;
  16. import org.springframework.core.io.buffer.DataBuffer;
  17. import org.springframework.data.redis.core.RedisTemplate;
  18. import org.springframework.http.HttpHeaders;
  19. import org.springframework.http.ReactiveHttpOutputMessage;
  20. import org.springframework.http.server.reactive.ServerHttpRequest;
  21. import org.springframework.http.server.reactive.ServerHttpRequestDecorator;
  22. import org.springframework.stereotype.Component;
  23. import org.springframework.util.AntPathMatcher;
  24. import org.springframework.util.CollectionUtils;
  25. import org.springframework.web.reactive.function.BodyInserter;
  26. import org.springframework.web.reactive.function.BodyInserters;
  27. import org.springframework.web.reactive.function.server.HandlerStrategies;
  28. import org.springframework.web.reactive.function.server.ServerRequest;
  29. import org.springframework.web.server.ServerWebExchange;
  30. import reactor.core.publisher.Flux;
  31. import reactor.core.publisher.Mono;
  33. import java.lang.reflect.Field;
  34. import java.net.URI;
  35. import java.util.List;
  36. import java.util.Map;
  37. import java.util.TreeMap;
  38. import java.util.concurrent.TimeUnit;
  41. /**
  42.  * @Description:
  43.  * @Author: rosh
  44.  * @Date: 2021/10/26 22:24
  45.  */
  46. @Configuration
  47. @Component
  48. public class GatewayFilterConfig implements GlobalFilter, Ordered {
  51.     @Autowired
  52.     private RedisTemplate<String, String> redisTemplate;
  55.     private static final String ERROR_MESSAGE = "拒绝服务";
  58.     @Override
  59.     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
  60.         //1 获取时间戳
  61.         Long dateTimestamp = getDateTimestamp(exchange.getRequest().getHeaders());
  62.         //2 获取RequestId
  63.         String requestId = getRequestId(exchange.getRequest().getHeaders());
  64.         //3 获取签名
  65.         String sign = getSign(exchange.getRequest().getHeaders());
  66.         //4 如果是登录不校验Token
  67.         String requestUrl = exchange.getRequest().getPath().value();
  68.         AntPathMatcher pathMatcher = new AntPathMatcher();
  69.         if (!pathMatcher.match("/user/login", requestUrl)) {
  70.             String token = exchange.getRequest().getHeaders().getFirst(UserConstant.TOKEN);
  71.             Claims claim = TokenUtils.getClaim(token);
  72.             if (StringUtils.isBlank(token) || claim == null) {
  73.                 return FilterUtils.invalidToken(exchange);
  74.             }
  75.         }
  76.         //5 修改请求参数,并获取请求参数
  77.         Map<String, Object> paramMap;
  78.         try {
  79.             paramMap = updateRequestParam(exchange);
  80.         } catch (Exception e) {
  81.             return FilterUtils.invalidUrl(exchange);
  82.         }
  83.         //6 获取请求体,修改请求体
  84.         ServerRequest serverRequest = ServerRequest.create(exchange, HandlerStrategies.withDefaults().messageReaders());
  85.         Mono<String> modifiedBody = serverRequest.bodyToMono(String.class).flatMap(body -> {
  86.             String encrypt = RSAUtils.decrypt(body, RSAConstant.PRIVATE_KEY);
  87.             JSONObject jsonObject = JSON.parseObject(encrypt);
  88.             for (Map.Entry<String, Object> entry : jsonObject.entrySet()) {
  89.                 paramMap.put(entry.getKey(), entry.getValue());
  90.             }
  91.             checkSign(sign, dateTimestamp, requestId, paramMap);
  92.             return Mono.just(encrypt);
  93.         });
  95.         //创建BodyInserter修改请求体
  97.         BodyInserter<Mono<String>, ReactiveHttpOutputMessage> bodyInserter = BodyInserters.fromPublisher(modifiedBody, String.class);
  98.         HttpHeaders headers = new HttpHeaders();
  99.         headers.putAll(exchange.getRequest().getHeaders());
  100.         headers.remove(HttpHeaders.CONTENT_LENGTH);
  101.         //创建CachedBodyOutputMessage并且把请求param加入,初始化校验信息
  102.         MyCachedBodyOutputMessage outputMessage = new MyCachedBodyOutputMessage(exchange, headers);
  103.         outputMessage.initial(paramMap, requestId, sign, dateTimestamp);
  104.         return bodyInserter.insert(outputMessage, new BodyInserterContext()).then(Mono.defer(() -> {
  105.             ServerHttpRequestDecorator decorator = new ServerHttpRequestDecorator(exchange.getRequest()) {
  106.                 @Override
  107.                 public Flux<DataBuffer> getBody() {
  108.                     Flux<DataBuffer> body = outputMessage.getBody();
  109.                     if (body.equals(Flux.empty())) {
  110.                         //验证签名
  111.                         checkSign(outputMessage.getSign(), outputMessage.getDateTimestamp(), outputMessage.getRequestId(), outputMessage.getParamMap());
  112.                     }
  113.                     return outputMessage.getBody();
  114.                 }
  115.             };
  116.             return chain.filter(exchange.mutate().request(decorator).build());
  117.         }));
  119.     }
  121.     public void checkSign(String sign, Long dateTimestamp, String requestId, Map<String, Object> paramMap) {
  122.         String str = JSON.toJSONString(paramMap) + requestId + dateTimestamp;
  123.         String tempSign = Md5Utils.getMD5(str.getBytes());
  124.         if (!tempSign.equals(sign)) {
  125.             throw new IllegalArgumentException(ERROR_MESSAGE);
  126.         }
  127.     }
  129.     /**
  130.      * 修改前端传的参数
  131.      */
  132.     private Map<String, Object> updateRequestParam(ServerWebExchange exchange) throws NoSuchFieldException, IllegalAccessException {
  133.         ServerHttpRequest request = exchange.getRequest();
  134.         URI uri = request.getURI();
  135.         String query = uri.getQuery();
  136.         if (StringUtils.isNotBlank(query) && query.contains("param")) {
  137.             String[] split = query.split("=");
  138.             String param = RSAUtils.decrypt(split[1], RSAConstant.PRIVATE_KEY);
  139.             Field targetQuery = uri.getClass().getDeclaredField("query");
  140.             targetQuery.setAccessible(true);
  141.             targetQuery.set(uri, param);
  142.             return getParamMap(param);
  143.         }
  144.         return new TreeMap<>();
  145.     }
  148.     private Map<String, Object> getParamMap(String param) {
  149.         Map<String, Object> map = new TreeMap<>();
  150.         String[] split = param.split("&");
  151.         for (String str : split) {
  152.             String[] params = str.split("=");
  153.             map.put(params[0], params[1]);
  154.         }
  155.         return map;
  156.     }
  159.     private String getSign(HttpHeaders headers) {
  160.         List<String> list = headers.get("sign");
  161.         if (CollectionUtils.isEmpty(list)) {
  162.             throw new IllegalArgumentException(ERROR_MESSAGE);
  163.         }
  164.         return list.get(0);
  165.     }
  167.     private Long getDateTimestamp(HttpHeaders httpHeaders) {
  168.         List<String> list = httpHeaders.get("timestamp");
  169.         if (CollectionUtils.isEmpty(list)) {
  170.             throw new IllegalArgumentException(ERROR_MESSAGE);
  171.         }
  172.         long timestamp = Long.parseLong(list.get(0));
  173.         long currentTimeMillis = System.currentTimeMillis();
  174.         //有效时长为5分钟
  175.         if (currentTimeMillis - timestamp > 1000 * 60 * 5) {
  176.             throw new IllegalArgumentException(ERROR_MESSAGE);
  177.         }
  178.         return timestamp;
  179.     }
  181.     private String getRequestId(HttpHeaders headers) {
  182.         List<String> list = headers.get("requestId");
  183.         if (CollectionUtils.isEmpty(list)) {
  184.             throw new IllegalArgumentException(ERROR_MESSAGE);
  185.         }
  186.         String requestId = list.get(0);
  187.         //如果requestId存在redis中直接返回
  188.         String temp = redisTemplate.opsForValue().get(requestId);
  189.         if (StringUtils.isNotBlank(temp)) {
  190.             throw new IllegalArgumentException(ERROR_MESSAGE);
  191.         }
  192.         redisTemplate.opsForValue().set(requestId, requestId, 5, TimeUnit.MINUTES);
  193.         return requestId;
  194.     }
  197.     @Override
  198.     public int getOrder() {
  199.         return 80;
  200.     }
  201. }



4.4 测试登录

发现验签成功
Gateway API接口安全设计（加密 、签名） - 图14

4.5 测试查询

验签成功
Gateway API接口安全设计（加密 、签名） - 图15