签名有效时间提升到30秒钟

chenjiahe

2022-08-11 2b35339fd67969df7acb8c75bfceafa1ba134b41

 src/main/java/com/platform/verification/VerificationTool.java

@@ -1,12 +1,14 @@
package com.platform.verification;


import com.hx.util.DateUtil;
import com.hx.util.StringUtils;
import com.hx.util.rsa.RSAUtil;
import com.platform.constants.LoginConstant;
import com.platform.entity.ThirtApplication;
import com.platform.resultTool.PlatformCode;
import com.platform.resultTool.PlatformResult;

import javax.servlet.http.HttpServletRequest;
import java.text.SimpleDateFormat;
import java.util.Date;

@@ -17,63 +19,68 @@
public class VerificationTool {

    /**校验方法请求
     * @param appId 用户的APPID
     * @param appId 用户的APPID `
     * @param sign 用户签名
     * @param sys_appId 系统的appid
     * @param sys_private_key 系统的RSA秘钥
     * @param thirtApplication ThirtApplication
     * @return
     */
    public static PlatformResult verification(String appId,String sign,String sys_appId,String sys_private_key){
    public static PlatformResult verification(String appId, String sign, ThirtApplication thirtApplication,HttpServletRequest request){

        if (StringUtils.isEmpty(sign)) {
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误");
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误01");
        }
        if (StringUtils.isEmpty(appId)) {
            return PlatformResult.failure(PlatformCode.ERROR_APPIS, "APPID错误");
        }

        //校验appid是否存在
        if(!sys_appId.equals("appId")){
            return PlatformResult.failure(PlatformCode.ERROR_APPIS, "APPID错误");
        if(thirtApplication == null){
            return PlatformResult.failure(PlatformCode.ERROR_APPIS, "APPID无效");
        }

        if(StringUtils.isEmpty(thirtApplication.getPrivateKey())){
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误,APPID无效");
        }

        //解密RSA
        String decrypt = null;
        try{
            decrypt = RSAUtil.privateDecrypt(sign, sys_private_key);
            decrypt = RSAUtil.privateDecrypt(sign, thirtApplication.getPrivateKey());
        }catch (Exception e){

        }
        if(StringUtils.isEmpty(decrypt)){
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误");
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误02");
        }

        //decrypt格式：appId_时间戳_随机数（尽量少）
        String[] decrypts = decrypt.split("_");
        if(decrypts.length != 3){
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误");
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误03");
        }

        if (!appId.equals(decrypts[0])) {
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误");
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误04");
        }

        Date date  = null;
        try{

            //判断接口时间
            SimpleDateFormat sdf= new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
            String sd = sdf.format(new Date(Long.parseLong(String.valueOf(decrypts[1]))));      // 时间戳转换成时间
            date = DateUtil.parseString(sd,"yyyy-MM-dd HH:mm:ss");
        }catch (Exception e){
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误");
            return PlatformResult.failure(PlatformCode.ERROR_SIGN, "签名错误05");
        }

        //接口有效2秒钟
        if(System.currentTimeMillis()-date.getTime() > 2000){
            return PlatformResult.failure(PlatformCode.ERROR_INVALID_VISIT, "访问无效");
        //接口有效30秒钟
        if(System.currentTimeMillis()-date.getTime() > 30000){
            return PlatformResult.failure(PlatformCode.ERRO_VISIT_OVERTIMR, "访问超时");
        }

        thirtApplication.setPrivateKey(null);
        request.getSession().setAttribute(LoginConstant.LOGIN_APPLY,thirtApplication);

        return PlatformResult.success();
    }