vincent
3 weeks ago
3 changed files with 162 additions and 8 deletions
@ -0,0 +1,153 @@ |
|||||
|
package com.zdxt.enforcementcode.controller.externalInterface; |
||||
|
|
||||
|
import cn.hutool.core.util.IdUtil; |
||||
|
import cn.hutool.crypto.SecureUtil; |
||||
|
import cn.hutool.crypto.asymmetric.KeyType; |
||||
|
import cn.hutool.http.HttpRequest; |
||||
|
import cn.hutool.http.HttpResponse; |
||||
|
import com.alibaba.fastjson2.JSONObject; |
||||
|
import com.zdxt.enforcementcode.common.util.ApiSignUtil; |
||||
|
|
||||
|
import java.nio.charset.StandardCharsets; |
||||
|
import java.util.HashMap; |
||||
|
import java.util.Map; |
||||
|
|
||||
|
public class ApiSignDemo { |
||||
|
|
||||
|
private static final String APP_KEY = "XXX"; |
||||
|
private static final String APP_SECRET = "XXX"; |
||||
|
|
||||
|
private static final String BASE_URL = "http://localhost:8080"; |
||||
|
|
||||
|
// 平台公钥：加密请求体
|
||||
|
private static final String PLATFORM_PUBLIC_KEY = "XXXXXX"; |
||||
|
// 调用方私钥：解密响应体
|
||||
|
private static final String CALLER_PRIVATE_KEY = "XXXXXX"; |
||||
|
|
||||
|
public static void main(String[] args) throws Exception { |
||||
|
System.out.println("========================================"); |
||||
|
System.out.println(" 模拟第三方请求 - 加签 + 加解密"); |
||||
|
System.out.println("========================================\n"); |
||||
|
|
||||
|
// =====================================================================
|
||||
|
// ① 加签：生成 HMAC-SHA256 签名
|
||||
|
// =====================================================================
|
||||
|
// timestamp: 毫秒级时间戳（13位），服务端校验与服务器时间差不超过配置阈值
|
||||
|
// nonce: 随机字符串，防止重放攻击
|
||||
|
// 签名原文: 将 appKey、timestamp、nonce 按 key 字母排序后拼接为 key=value&key=value 格式
|
||||
|
// 签名值: 使用 HmacSHA256 算法 + appSecret 对签名原文计算摘要，结果 Base64 编码
|
||||
|
String timestamp = String.valueOf(System.currentTimeMillis()); |
||||
|
String nonce = IdUtil.fastSimpleUUID(); |
||||
|
|
||||
|
Map<String, String> signParams = new HashMap<>(); |
||||
|
signParams.put("appKey", APP_KEY); |
||||
|
signParams.put("timestamp", timestamp); |
||||
|
signParams.put("nonce", nonce); |
||||
|
|
||||
|
// buildSignContent: TreeMap 排序 → 过滤空值 → 拼接 "appKey=xxx&nonce=xxx×tamp=xxx"
|
||||
|
String signContent = ApiSignUtil.buildSignContent(signParams); |
||||
|
// hmacSign: HmacSHA256(签名原文, appSecret) → Base64 编码
|
||||
|
String sign = ApiSignUtil.hmacSign(signContent, APP_SECRET); |
||||
|
|
||||
|
System.out.println("【签名参数】"); |
||||
|
System.out.println(" App-Key: " + APP_KEY); |
||||
|
System.out.println(" Timestamp: " + timestamp); |
||||
|
System.out.println(" Nonce: " + nonce); |
||||
|
System.out.println(" 签名原文: " + signContent); |
||||
|
System.out.println(" Sign: " + sign); |
||||
|
System.out.println(); |
||||
|
|
||||
|
// =====================================================================
|
||||
|
// ② 构建业务请求体（JSON 格式，与 Controller 的 @RequestBody Bo 类字段对应）
|
||||
|
// =====================================================================
|
||||
|
String rawBody = """ |
||||
|
{ |
||||
|
"planType": 1, |
||||
|
"planDate": "2026-09-03", |
||||
|
"planTime": 1, |
||||
|
"enforceContent": "日常环保执法检查0904", |
||||
|
"enterpriseName": "深新粤云（深圳）信息技术有限公司圳市XX科技有限公司", |
||||
|
"enterpriseNumber": "91440300769156389U", |
||||
|
"contactPerson": "张三", |
||||
|
"contactPhone": "13800138000", |
||||
|
"enforceUserNames": "测试1,测试2", |
||||
|
"enforceUserIds": "17608417058,17608416858", |
||||
|
"deptId": "20210922212955057-A601-27251E588", |
||||
|
"deptName": "深圳市司法局", |
||||
|
"createBy": "17608417058", |
||||
|
"remark": "测试数据", |
||||
|
"outSerialNo": "LG20260903001" |
||||
|
}"""; |
||||
|
|
||||
|
System.out.println("【原始请求体】"); |
||||
|
System.out.println(" " + rawBody); |
||||
|
System.out.println(); |
||||
|
|
||||
|
// =====================================================================
|
||||
|
// ③ 加密请求体：RSA 公钥加密（使用平台公钥，服务端用平台私钥解密）
|
||||
|
// =====================================================================
|
||||
|
// 加密后的密文是 Base64 编码的字符串，不再是可读的 JSON
|
||||
|
// 服务端 ApiCryptoFilter 会用 platformPrivateKey 解密还原为原始 JSON
|
||||
|
String requestBody = ApiSignUtil.rsaEncrypt(rawBody, PLATFORM_PUBLIC_KEY); |
||||
|
System.out.println("【加密后请求体】"); |
||||
|
System.out.println(" " + requestBody.substring(0, Math.min(80, requestBody.length())) + "..."); |
||||
|
System.out.println(); |
||||
|
|
||||
|
// =====================================================================
|
||||
|
// ④ 发起 HTTP POST 请求
|
||||
|
// =====================================================================
|
||||
|
// 请求头说明：
|
||||
|
// App-Key: 应用标识，服务端通过它查 sys_api_platform_config 获取密钥和渠道信息
|
||||
|
// Timestamp: 毫秒级时间戳，服务端校验请求是否过期
|
||||
|
// Nonce: 随机串，防重放
|
||||
|
// Sign: HMAC-SHA256 签名值，服务端用 appSecret 验签
|
||||
|
// Encrypted: 标记请求体已加密，触发服务端 ApiCryptoFilter 解密逻辑
|
||||
|
// Content-Type: 固定为 application/json
|
||||
|
//
|
||||
|
// 服务端处理链路：
|
||||
|
// ApiCryptoFilter(解密请求体) → ApiSignInterceptor(验签) → Controller(业务处理)
|
||||
|
String url = BASE_URL + "/external/api/lg/plan/saveOrUpdatePlan"; |
||||
|
System.out.println("【发送请求】"); |
||||
|
System.out.println(" URL: " + url); |
||||
|
|
||||
|
HttpResponse response = HttpRequest.post(url) |
||||
|
.header("App-Key", APP_KEY) |
||||
|
.header("Timestamp", timestamp) |
||||
|
.header("Nonce", nonce) |
||||
|
.header("Sign", sign) |
||||
|
.header("Encrypted", "true") |
||||
|
.header("Content-Type", "application/json;charset=UTF-8") |
||||
|
.body(requestBody) |
||||
|
.timeout(10000) |
||||
|
.execute(); |
||||
|
|
||||
|
System.out.println(" 状态码: " + response.getStatus()); |
||||
|
System.out.println(" Encrypted: " + response.header("Encrypted")); |
||||
|
System.out.println(); |
||||
|
|
||||
|
// =====================================================================
|
||||
|
// ⑤ 解密响应体：RSA 私钥解密（服务端用调用方公钥加密，调用方用自己的私钥解密）
|
||||
|
// =====================================================================
|
||||
|
// 服务端 ApiCryptoFilter 处理完业务后，用 callerPublicKey 加密响应体
|
||||
|
// 调用方收到密文后，用 callerPrivateKey 解密还原为原始 JSON 响应
|
||||
|
String responseBody = response.body(); |
||||
|
System.out.println("【加密响应】"); |
||||
|
System.out.println(" " + (responseBody.length() > 200 ? responseBody.substring(0, 200) + "..." : responseBody)); |
||||
|
System.out.println(); |
||||
|
|
||||
|
// SecureUtil.rsa(privateKey, null): 用调用方私钥构造 RSA 解密器
|
||||
|
// decryptStr: Base64 解码密文 → RSA 私钥解密 → UTF-8 字符串
|
||||
|
String decryptedResponse = SecureUtil.rsa(CALLER_PRIVATE_KEY, null) |
||||
|
.decryptStr(responseBody, KeyType.PrivateKey, StandardCharsets.UTF_8); |
||||
|
|
||||
|
System.out.println("【解密后响应】"); |
||||
|
JSONObject json = JSONObject.parseObject(decryptedResponse); |
||||
|
System.out.println(" " + json.toString()); |
||||
|
|
||||
|
response.close(); |
||||
|
System.out.println(); |
||||
|
System.out.println("========================================"); |
||||
|
System.out.println(" 请求完成"); |
||||
|
System.out.println("========================================"); |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue