SpringMVC请求参数和响应结果全局加密和解密
前提
前段时间在作一个对外的网关项目，涉及到加密和解密模块，这里详细分析解决方案和适用的场景。为了模拟真实的交互场景，先定制一下整个交互流程。第三方传输(包括请求和响应)数据报文包括三个部分：java
- 一、timestamp，long类型，时间戳。
- 二、data，String类型，实际的业务请求数据转化成的Json字符串再进行加密获得的密文。
- 三、sign，签名，生成规则算法伪代码是SHA-256(data=xxx×tamp=11111)，防篡改。
为了简单起见，加密和解密采用AES，对称秘钥为"throwable"。上面的场景和加解密例子仅仅是为了模拟真实场景，安全系数低，切勿直接用于生产环境。web
如今还有一个地方要考虑，就是没法得知第三方如何提交请求数据，假定都是采用POST的Http请求方法，提交报文的时候指定ContentType为application/json或者application/x-www-form-urlencoded，两种ContentType提交方式的请求体是不相同的：算法
//application/x-www-form-urlencoded
timestamp=xxxx&data=yyyyyy&sign=zzzzzzz
//application/json
{"timestamp":xxxxxx,"data":"yyyyyyyy","sign":"zzzzzzz"}
最后一个要考虑的地方是，第三方强制要求部分接口须要用明文进行请求，在提供一些接口方法的时候，容许使用明文交互。总结一下就是要作到如下三点：spring
- 一、须要加解密的接口请求参数要进行解密，响应结果要进行加密。
- 二、不须要加解密的接口能够用明文请求。
- 三、兼容ContentType为application/json或者application/x-www-form-urlencoded两种方式。
上面三种状况要同时兼容算是十分严苛的场景，在生产环境中可能也是极少状况下才遇到，不过仍是能找到相对优雅的解决方案。先定义两个特定场景的接口：apache
一、下单接口(加密)json
- URL：/order/save
- HTTP METHOD：POST
- ContentType：application/x-www-form-urlencoded
- 原始参数：orderId=yyyyyyyyy&userId=xxxxxxxxx&amount=zzzzzzzzz
- 加密参数：timestamp=xxxx&data=yyyyyy&sign=zzzzzzz
二、订单查询接口(明文)数组
- URL：/order/query
- ContentType：application/json
- HTTP METHOD：POST
- 原始参数：{"userId":"xxxxxxxx"}
两个接口的ContentType不相同是为了故意复杂化场景，在下面的可取方案中，作法是把application/x-www-form-urlencoded中的形式如xxx=yyy&aaa=bbb的表单参数和application/json中形式如{"key":"value"}的请求参数统一当作application/json形式的参数处理，这样的话，咱们就能够直接在控制器方法中使用@RequestBody。安全
方案
咱们首先基于上面说到的加解密方案，提供一个加解密工具类：mvc
public enum EncryptUtils {
/**
* SINGLETON
*/
SINGLETON;
private static final String SECRET = "throwable";
private static final String CHARSET = "UTF-8";
public String sha(String raw) throws Exception {
MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
messageDigest.update(raw.getBytes(CHARSET));
return Hex.encodeHexString(messageDigest.digest());
}
private Cipher createAesCipher() throws Exception {
return Cipher.getInstance("AES");
}
public String encryptByAes(String raw) throws Exception {
Cipher aesCipher = createAesCipher();
KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
keyGenerator.init(128, new SecureRandom(SECRET.getBytes(CHARSET)));
SecretKey secretKey = keyGenerator.generateKey();
SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getEncoded(), "AES");
aesCipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
byte[] bytes = aesCipher.doFinal(raw.getBytes(CHARSET));
return Hex.encodeHexString(bytes);
}
public String decryptByAes(String raw) throws Exception {
byte[] bytes = Hex.decodeHex(raw);
Cipher aesCipher = createAesCipher();
KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
keyGenerator.init(128, new SecureRandom(SECRET.getBytes(CHARSET)));
SecretKey secretKey = keyGenerator.generateKey();
SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getEncoded(), "AES");
aesCipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
return new String(aesCipher.doFinal(bytes), CHARSET);
}
}
注意为了简化加解密操做引入了apache的codec依赖：app
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
<version>1.11</version>
</dependency>
上面的加解密过程当中要注意两点：
- 一、加密后的结果是byte数组，要把二进制转化为十六进制字符串。
- 二、解密的时候要把原始密文由十六进制转化为二进制的byte数组。
上面两点必须注意，不然会产生乱码，这个和编码相关，具体能够看以前写的一篇博客。
不推荐的方案
其实最暴力的方案是直接定制每一个控制器的方法参数类型，由于咱们能够和第三方磋商哪些请求路径须要加密，哪些是不须要加密，甚至哪些是application/x-www-form-urlencoded，哪些是application/json的请求，这样咱们能够经过大量的硬编码达到最终的目标。举个例子：
@RestController
public class Controller1 {
@Autowired
private ObjectMapper objectMapper;
@PostMapping(value = "/order/save",
consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public ResponseEntity<EncryptModel> saveOrder(@RequestParam(name = "sign") String sign,
@RequestParam(name = "timestamp") Long timestamp,
@RequestParam(name = "data") String data) throws Exception {
EncryptModel model = new EncryptModel();
model.setData(data);
model.setTimestamp(timestamp);
model.setSign(sign);
String inRawSign = String.format("data=%s×tamp=%d", model.getData(), model.getTimestamp());
String inSign = EncryptUtils.SINGLETON.sha(inRawSign);
if (!inSign.equals(model.getSign())){
throw new IllegalArgumentException("验证参数签名失败!");
}
//这里忽略实际的业务逻辑,简单设置返回的data为一个map
Map<String, Object> result = new HashMap<>(8);
result.put("code", "200");
result.put("message", "success");
EncryptModel out = new EncryptModel();
out.setTimestamp(System.currentTimeMillis());
out.setData(EncryptUtils.SINGLETON.encryptByAes(objectMapper.writeValueAsString(result)));
String rawSign = String.format("data=%s×tamp=%d", out.getData(), out.getTimestamp());
out.setSign(EncryptUtils.SINGLETON.sha(rawSign));
return ResponseEntity.ok(out);
}
@PostMapping(value = "/order/query",
consumes = MediaType.APPLICATION_JSON_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public ResponseEntity<Order> queryOrder(@RequestBody User user){
Order order = new Order();
//这里忽略实际的业务逻辑
return ResponseEntity.ok(order);
}
}
这种作法能在短期完成对应的加解密功能，不须要加解密的接口不用引入相关的代码便可。缺陷十分明显，存在硬编码、代码冗余等问题，一旦接口增多，项目的维护难度大大提升。所以，这种作法是不可取的。
混合方案之Filter和SpringMVC的Http消息转换器
这里先说一点，这里是在SpringMVC中使用Filter。由于要兼容两种contentType，咱们须要作到几点：
- 一、修改请求头的contentType为application/json。
- 二、修改请求体中的参数，统一转化为InputStream。
- 三、定制URL规则，区别须要加解密和不须要加解密的URL。
使用Filter有一个优势：不须要理解SpringMVC的流程，也不须要扩展SpringMVC的相关组件。缺点也比较明显：
- 一、若是须要区分加解密，只能经过URL规则进行过滤。
- 二、须要加密的接口的SpringMVC控制器的返回参数必须是加密后的实体类，没法作到加密逻辑和业务逻辑彻底拆分，也就是解密逻辑对接收的参数是无感知，可是加密逻辑对返回结果是有感知的。
PS：上面提到的几个须要修改请求参数、请求头等是由于特殊场景的定制，因此若是无此场景能够直接看下面的"单纯的Json请求参数和Json响应结果"小节。流程大体以下：
编写Filter的实现和HttpServletRequestWrapper的实现：
//CustomEncryptFilter
@RequiredArgsConstructor
public class CustomEncryptFilter extends OncePerRequestFilter {
private final ObjectMapper objectMapper;
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
//Content-Type
String contentType = request.getContentType();
String requestBody = null;
boolean shouldEncrypt = false;
if (StringUtils.substringMatch(contentType, 0, MediaType.APPLICATION_FORM_URLENCODED_VALUE)) {
shouldEncrypt = true;
requestBody = convertFormToString(request);
} else if (StringUtils.substringMatch(contentType, 0, MediaType.APPLICATION_JSON_VALUE)) {
shouldEncrypt = true;
requestBody = convertInputStreamToString(request.getInputStream());
}
if (!shouldEncrypt) {
filterChain.doFilter(request, response);
} else {
CustomEncryptHttpWrapper wrapper = new CustomEncryptHttpWrapper(request, requestBody);
wrapper.putHeader("Content-Type", MediaType.APPLICATION_PROBLEM_JSON_UTF8_VALUE);
filterChain.doFilter(wrapper, response);
}
}
private String convertFormToString(HttpServletRequest request) {
Map<String, String> result = new HashMap<>(8);
Enumeration<String> parameterNames = request.getParameterNames();
while (parameterNames.hasMoreElements()) {
String name = parameterNames.nextElement();
result.put(name, request.getParameter(name));
}
try {
return objectMapper.writeValueAsString(result);
} catch (JsonProcessingException e) {
throw new IllegalArgumentException(e);
}
}
private String convertInputStreamToString(InputStream inputStream) throws IOException {
return StreamUtils.copyToString(inputStream, Charset.forName("UTF-8"));
}
}
//CustomEncryptHttpWrapper
public class CustomEncryptHttpWrapper extends HttpServletRequestWrapper {
private final Map<String, String> headers = new HashMap<>(8);
private final byte[] data;
public CustomEncryptHttpWrapper(HttpServletRequest request, String content) {
super(request);
data = content.getBytes(Charset.forName("UTF-8"));
Enumeration<String> headerNames = request.getHeaderNames();
while (headerNames.hasMoreElements()) {
String key = headerNames.nextElement();
headers.put(key, request.getHeader(key));
}
}
public void putHeader(String key, String value) {
headers.put(key, value);
}
@Override
public String getHeader(String name) {
return headers.get(name);
}
@Override
public Enumeration<String> getHeaders(String name) {
return Collections.enumeration(Collections.singletonList(headers.get(name)));
}
@Override
public Enumeration<String> getHeaderNames() {
return Collections.enumeration(headers.keySet());
}
@Override
public ServletInputStream getInputStream() throws IOException {
ByteArrayInputStream inputStream = new ByteArrayInputStream(data);
return new ServletInputStream() {
@Override
public boolean isFinished() {
return !isReady();
}
@Override
public boolean isReady() {
return inputStream.available() > 0;
}
@Override
public void setReadListener(ReadListener listener) {
}
@Override
public int read() throws IOException {
return inputStream.read();
}
};
}
@Override
public BufferedReader getReader() throws IOException {
return super.getReader();
}
}
//CustomEncryptConfiguration
@Configuration
public class CustomEncryptConfiguration {
@Bean
public FilterRegistrationBean<CustomEncryptFilter> customEncryptFilter(ObjectMapper objectMapper){
FilterRegistrationBean<CustomEncryptFilter> bean = new FilterRegistrationBean<>(new CustomEncryptFilter(objectMapper));
bean.addUrlPatterns("/e/*");
return bean;
}
}
控制器代码：
//可加密的，空接口
public interface Encryptable {
}
@Data
public class Order implements Encryptable{
private Long userId;
}
@Data
public class EncryptResponse<T> implements Encryptable {
private Integer code;
private T data;
}
@RequiredArgsConstructor
@RestController
public class Controller {
private final ObjectMapper objectMapper;
@PostMapping(value = "/e/order/save",
consumes = MediaType.APPLICATION_JSON_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public EncryptResponse<Order> saveOrder(@RequestBody Order order) throws Exception {
//这里忽略实际的业务逻辑,简单设置返回的data为一个map
EncryptResponse<Order> response = new EncryptResponse<>();
response.setCode(200);
response.setData(order);
return response;
}
@PostMapping(value = "/c/order/query",
consumes = MediaType.APPLICATION_JSON_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public ResponseEntity<Order> queryOrder(@RequestBody User user) {
Order order = new Order();
//这里忽略实际的业务逻辑
return ResponseEntity.ok(order);
}
}
这里可能有人有疑问，为何不在Filter作加解密的操做？由于考虑到场景太特殊，要兼容两种形式的表单提交参数，若是在Filter作加解密操做，会影响到Controller的编码，这就违反了全局加解密不影响到里层业务代码的目标。上面的Filter只会拦截URL知足/e/*的请求，所以查询接口/c/order/query不会受到影响。这里使用了标识接口用于决定请求参数或者响应结果是否须要加解密，也就是只须要在HttpMessageConverter中判断请求参数的类型或者响应结果的类型是否加解密标识接口的子类：
@RequiredArgsConstructor
public class CustomEncryptHttpMessageConverter extends MappingJackson2HttpMessageConverter {
private final ObjectMapper objectMapper;
@Override
protected Object readInternal(Class<?> clazz, HttpInputMessage inputMessage)
throws IOException, HttpMessageNotReadableException {
if (Encryptable.class.isAssignableFrom(clazz)) {
EncryptModel in = objectMapper.readValue(StreamUtils.copyToByteArray(inputMessage.getBody()), EncryptModel.class);
String inRawSign = String.format("data=%s×tamp=%d", in.getData(), in.getTimestamp());
String inSign;
try {
inSign = EncryptUtils.SINGLETON.sha(inRawSign);
} catch (Exception e) {
throw new IllegalArgumentException("验证参数签名失败!");
}
if (!inSign.equals(in.getSign())) {
throw new IllegalArgumentException("验证参数签名失败!");
}
try {
return objectMapper.readValue(EncryptUtils.SINGLETON.decryptByAes(in.getData()), clazz);
} catch (Exception e) {
throw new IllegalArgumentException("解密失败!");
}
} else {
return super.readInternal(clazz, inputMessage);
}
}
@Override
protected void writeInternal(Object object, Type type, HttpOutputMessage outputMessage)
throws IOException, HttpMessageNotWritableException {
Class<?> clazz = (Class) type;
if (Encryptable.class.isAssignableFrom(clazz)) {
EncryptModel out = new EncryptModel();
out.setTimestamp(System.currentTimeMillis());
try {
out.setData(EncryptUtils.SINGLETON.encryptByAes(objectMapper.writeValueAsString(object)));
String rawSign = String.format("data=%s×tamp=%d", out.getData(), out.getTimestamp());
out.setSign(EncryptUtils.SINGLETON.sha(rawSign));
} catch (Exception e) {
throw new IllegalArgumentException("参数签名失败!");
}
super.writeInternal(out, type, outputMessage);
} else {
super.writeInternal(object, type, outputMessage);
}
}
}
自实现的HttpMessageConverter主要须要判断请求参数的类型和返回值的类型，从而判断是否须要进行加解密。
单纯的Json请求参数和Json响应结果的加解密处理最佳实践
通常状况下，对接方的请求参数和响应结果是彻底规范统一使用Json(contentType指定为application/json，使用@RequestBody接收参数)，那么全部的事情就会变得简单，由于不须要考虑请求参数由xxx=yyy&aaa=bbb转换为InputStream再交给SpringMVC处理，所以咱们只须要提供一个MappingJackson2HttpMessageConverter子类实现(继承它而且覆盖对应方法，添加加解密特性)。咱们仍是使用标识接口用于决定请求参数或者响应结果是否须要加解密：
@RequiredArgsConstructor
public class CustomEncryptHttpMessageConverter extends MappingJackson2HttpMessageConverter {
private final ObjectMapper objectMapper;
@Override
protected Object readInternal(Class<?> clazz, HttpInputMessage inputMessage)
throws IOException, HttpMessageNotReadableException {
if (Encryptable.class.isAssignableFrom(clazz)) {
EncryptModel in = objectMapper.readValue(StreamUtils.copyToByteArray(inputMessage.getBody()), EncryptModel.class);
String inRawSign = String.format("data=%s×tamp=%d", in.getData(), in.getTimestamp());
String inSign;
try {
inSign = EncryptUtils.SINGLETON.sha(inRawSign);
} catch (Exception e) {
throw new IllegalArgumentException("验证参数签名失败!");
}
if (!inSign.equals(in.getSign())) {
throw new IllegalArgumentException("验证参数签名失败!");
}
try {
return objectMapper.readValue(EncryptUtils.SINGLETON.decryptByAes(in.getData()), clazz);
} catch (Exception e) {
throw new IllegalArgumentException("解密失败!");
}
} else {
return super.readInternal(clazz, inputMessage);
}
}
@Override
protected void writeInternal(Object object, Type type, HttpOutputMessage outputMessage)
throws IOException, HttpMessageNotWritableException {
Class<?> clazz = (Class) type;
if (Encryptable.class.isAssignableFrom(clazz)) {
EncryptModel out = new EncryptModel();
out.setTimestamp(System.currentTimeMillis());
try {
out.setData(EncryptUtils.SINGLETON.encryptByAes(objectMapper.writeValueAsString(object)));
String rawSign = String.format("data=%s×tamp=%d", out.getData(), out.getTimestamp());
out.setSign(EncryptUtils.SINGLETON.sha(rawSign));
} catch (Exception e) {
throw new IllegalArgumentException("参数签名失败!");
}
super.writeInternal(out, type, outputMessage);
} else {
super.writeInternal(object, type, outputMessage);
}
}
}
没错，代码是拷贝上一节提供的HttpMessageConverter实现，而后控制器方法的参数使用@RequestBody注解而且类型实现加解密标识接口Encryptable便可，返回值的类型也须要实现加解密标识接口Encryptable。这种作法可让控制器的代码对加解密彻底无感知。固然，也能够不改变原来的MappingJackson2HttpMessageConverter实现，使用RequestBodyAdvice和ResponseBodyAdvice完成相同的功能：
@RequiredArgsConstructor
public class CustomRequestBodyAdvice extends RequestBodyAdviceAdapter {
private final ObjectMapper objectMapper;
@Override
public boolean supports(MethodParameter methodParameter, Type targetType,
Class<? extends HttpMessageConverter<?>> converterType) {
Class<?> clazz = (Class) targetType;
return Encryptable.class.isAssignableFrom(clazz);
}
@Override
public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage, MethodParameter parameter, Type targetType,
Class<? extends HttpMessageConverter<?>> converterType) throws IOException {
Class<?> clazz = (Class) targetType;
if (Encryptable.class.isAssignableFrom(clazz)) {
String content = StreamUtils.copyToString(inputMessage.getBody(), Charset.forName("UTF-8"));
EncryptModel in = objectMapper.readValue(content, EncryptModel.class);
String inRawSign = String.format("data=%s×tamp=%d", in.getData(), in.getTimestamp());
String inSign;
try {
inSign = EncryptUtils.SINGLETON.sha(inRawSign);
} catch (Exception e) {
throw new IllegalArgumentException("验证参数签名失败!");
}
if (!inSign.equals(in.getSign())) {
throw new IllegalArgumentException("验证参数签名失败!");
}
ByteArrayInputStream inputStream = new ByteArrayInputStream(in.getData().getBytes(Charset.forName("UTF-8")));
return new MappingJacksonInputMessage(inputStream, inputMessage.getHeaders());
} else {
return super.beforeBodyRead(inputMessage, parameter, targetType, converterType);
}
}
}
@RequiredArgsConstructor
public class CustomResponseBodyAdvice extends JsonViewResponseBodyAdvice {
private final ObjectMapper objectMapper;
@Override
public boolean supports(MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
Class<?> parameterType = returnType.getParameterType();
return Encryptable.class.isAssignableFrom(parameterType);
}
@Override
protected void beforeBodyWriteInternal(MappingJacksonValue bodyContainer, MediaType contentType,
MethodParameter returnType, ServerHttpRequest request,
ServerHttpResponse response) {
Class<?> parameterType = returnType.getParameterType();
if (Encryptable.class.isAssignableFrom(parameterType)) {
EncryptModel out = new EncryptModel();
out.setTimestamp(System.currentTimeMillis());
try {
out.setData(EncryptUtils.SINGLETON.encryptByAes(objectMapper.writeValueAsString(bodyContainer.getValue())));
String rawSign = String.format("data=%s×tamp=%d", out.getData(), out.getTimestamp());
out.setSign(EncryptUtils.SINGLETON.sha(rawSign));
out.setSign(EncryptUtils.SINGLETON.sha(rawSign));
} catch (Exception e) {
throw new IllegalArgumentException("参数签名失败!");
}
} else {
super.beforeBodyWriteInternal(bodyContainer, contentType, returnType, request, response);
}
}
}
单纯的application/x-www-form-urlencoded表单请求参数和Json响应结果的加解密处理最佳实践
通常状况下，对接方的请求参数彻底采用application/x-www-form-urlencoded表单请求参数返回结果所有按照Json接收，咱们也能够经过一个HttpMessageConverter实现就完成加解密模块。
public class FormHttpMessageConverter implements HttpMessageConverter<Object> {
private final List<MediaType> mediaTypes;
private final ObjectMapper objectMapper;
public FormHttpMessageConverter(ObjectMapper objectMapper) {
this.objectMapper = objectMapper;
this.mediaTypes = new ArrayList<>(1);
this.mediaTypes.add(MediaType.APPLICATION_FORM_URLENCODED);
}
@Override
public boolean canRead(Class<?> clazz, MediaType mediaType) {
return Encryptable.class.isAssignableFrom(clazz) && mediaTypes.contains(mediaType);
}
@Override
public boolean canWrite(Class<?> clazz, MediaType mediaType) {
return Encryptable.class.isAssignableFrom(clazz) && mediaTypes.contains(mediaType);
}
@Override
public List<MediaType> getSupportedMediaTypes() {
return mediaTypes;
}
@Override
public Object read(Class<?> clazz, HttpInputMessage inputMessage) throws
IOException, HttpMessageNotReadableException {
if (Encryptable.class.isAssignableFrom(clazz)) {
String content = StreamUtils.copyToString(inputMessage.getBody(), Charset.forName("UTF-8"));
EncryptModel in = objectMapper.readValue(content, EncryptModel.class);
String inRawSign = String.format("data=%s×tamp=%d", in.getData(), in.getTimestamp());
String inSign;
try {
inSign = EncryptUtils.SINGLETON.sha(inRawSign);
} catch (Exception e) {
throw new IllegalArgumentException("验证参数签名失败!");
}
if (!inSign.equals(in.getSign())) {
throw new IllegalArgumentException("验证参数签名失败!");
}
try {
return objectMapper.readValue(EncryptUtils.SINGLETON.decryptByAes(in.getData()), clazz);
} catch (Exception e) {
throw new IllegalArgumentException("解密失败!");
}
} else {
MediaType contentType = inputMessage.getHeaders().getContentType();
Charset charset = (contentType != null && contentType.getCharset() != null ?
contentType.getCharset() : Charset.forName("UTF-8"));
String body = StreamUtils.copyToString(inputMessage.getBody(), charset);
String[] pairs = StringUtils.tokenizeToStringArray(body, "&");
MultiValueMap<String, String> result = new LinkedMultiValueMap<>(pairs.length);
for (String pair : pairs) {
int idx = pair.indexOf('=');
if (idx == -1) {
result.add(URLDecoder.decode(pair, charset.name()), null);
} else {
String name = URLDecoder.decode(pair.substring(0, idx), charset.name());
String value = URLDecoder.decode(pair.substring(idx + 1), charset.name());
result.add(name, value);
}
}
return result;
}
}
@Override
public void write(Object o, MediaType contentType, HttpOutputMessage outputMessage)
throws IOException, HttpMessageNotWritableException {
Class<?> clazz = o.getClass();
if (Encryptable.class.isAssignableFrom(clazz)) {
EncryptModel out = new EncryptModel();
out.setTimestamp(System.currentTimeMillis());
try {
out.setData(EncryptUtils.SINGLETON.encryptByAes(objectMapper.writeValueAsString(o)));
String rawSign = String.format("data=%s×tamp=%d", out.getData(), out.getTimestamp());
out.setSign(EncryptUtils.SINGLETON.sha(rawSign));
StreamUtils.copy(objectMapper.writeValueAsString(out)
.getBytes(Charset.forName("UTF-8")), outputMessage.getBody());
} catch (Exception e) {
throw new IllegalArgumentException("参数签名失败!");
}
} else {
String out = objectMapper.writeValueAsString(o);
StreamUtils.copy(out.getBytes(Charset.forName("UTF-8")), outputMessage.getBody());
}
}
}
上面的HttpMessageConverter的实现能够参考org.springframework.http.converter.FormHttpMessageConverter。
小结
这篇文章强行复杂化了实际的状况(可是在实际中真的碰到过)，通常状况下，如今流行使用Json进行数据传输，在SpringMVC项目中，咱们只须要针对性地改造MappingJackson2HttpMessageConverter便可(继承而且添加特性)，若是对SpringMVC的源码相对熟悉的话，直接添加自定义的RequestBodyAdvice(RequestBodyAdviceAdapter)和ResponseBodyAdvice(JsonViewResponseBodyAdvice)实现也能够达到目的。至于为何使用HttpMessageConverter作加解密功能，这里基于SpringMVC源码的对请求参数处理的过程整理了一张处理流程图：
上面流程最核心的代码能够看AbstractMessageConverterMethodArgumentResolver#readWithMessageConverters和HandlerMethodArgumentResolverComposite#resolveArgument，毕竟源码不会骗人。控制器方法返回值的处理是基本对称的，阅读起来也比较轻松。
参考资料：
- spring-boot-web-starter:2.0.3.RELEASE源码。
（本文完 c-d-4）
相关文章
- 1. SpringMVC请求参数和响应结果全局加密和解密
- 2. 解密HTTP请求和响应过程
- 3. url 请求参数加密
- 4. 前端请求参数MD5加密校验,参数串解密
- 5. SpringMVC响应数据和结果视图
- 6. http请求和响应报文全解
- 7. asp.net MVC ajax 请求参数前台加密后台解密
- 8. jmeter md5加密请求参数
- 9. 请求和响应
- 10. jmeter 请求发送加密参数(加密接口测试一)
- 更多相关文章...
- • HTTP 请求方法 - HTTP 教程
- • ASP.NET MVC - 样式和布局 - ASP.NET 教程
- • TiDB 在摩拜单车在线数据业务的应用和实践
- • Flink 数据传输及反压详解
相关标签/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
最新文章
- 1. No provider available from registry 127.0.0.1:2181 for service com.ddbuy.ser 解决方法
- 2. Qt5.7以上调用虚拟键盘(支持中文)，以及源码修改(可拖动，水平缩放)
- 3. 软件测试面试- 购物车功能测试用例设计
- 4. ElasticSearch（概念篇）：你知道的, 为了搜索…
- 5. redux理解
- 6. gitee创建第一个项目
- 7. 支持向量机之硬间隔（一步步推导，通俗易懂）
- 8. Mysql 异步复制延迟的原因及解决方案
- 9. 如何在运行SEPM配置向导时将不可认的复杂数据库密码改为简单密码
- 10. windows系统下tftp服务器使用
欢迎关注本站公众号,获取更多信息
相关文章