接口验签规则_代码007(未授权)

在网络发展快速的过程中，总是会忽略接口数据安全问题，进行验签则能够在一定程度上能够防刷，数据篡改。

加签验签，

发送消息方，对消息加签名；

发送消息方：

1、根据消息内容形成摘要

接口：home/timestamp
方式：GET
返回：
{
    "code": 200,
    "message": "operation success",
    "data": 1668653868836,
    "timestamp": 1668653868836,
    "success": true
}

public void checkSign(String sign, Map<String, String> requestParam,String timestamp, String requestId, URI uri){
        if (StrUtil.isBlank(sign) || StrUtil.isBlank(timestamp) || StrUtil.isBlank(requestId)) {
            LOGGER.error("illegal request  sign:{} timestamp:{}  requestId:{}",sign,timestamp,requestId);
            throw new ApiException("illegal request,param is null!");
        }

        long time;
        try {
            time = Long.parseLong(timestamp);
        } catch (Exception e) {
            LOGGER.error("illegal request  timestamp不合法,timestamp:" + timestamp);
            throw new ApiException("timestamp illegal");
        }
        //验证时间戳是否过期
        long currentTime = System.currentTimeMillis();
        if (time > currentTime + timeOver || time < currentTime - timeOver) {
            LOGGER.error("illegal request  timestamp expires now:{} timestamp:{}",currentTime,time);
            throw new ApiException("please refresh");
        }

        if(redisTemplate.hasKey(requestId)){
            LOGGER.error("illegal request  requestId exist:{}",requestId);
            throw new ApiException("illegal request,requestId exist:"+requestId);
        }else{
            redisTemplate.opsForValue().set(requestId, requestId,timeOver, TimeUnit.MILLISECONDS);
        }
        String paramAscII = MapUtil.sortJoin(requestParam, "&amp;", "=", true, requestId, timestamp);

        String md5 = new Digester(DigestAlgorithm.MD5).digestHex(paramAscII);
        if (!md5.equals(sign)) {
            LOGGER.error("illegal request,check sign fail! paramAscII:{} sourceSign:{}  sysSign:{}",paramAscII,sign,md5);
            throw new ApiException("illegal request,check sign fail");
        }
    }