加签验签概念 加签: 用Hash函数把原始报文生成报文摘要,然后用私钥对这个摘要进行加密,就得到这个报文对应的数字签名。「注意啦,加签过程要包含一些特殊的私有的东西,比如个人私钥。」
用Hash函数把原始报文生成报文摘要,然后用私钥对这个摘要进行加密,就得到这个报文对应的数字签名。「注意啦,加签过程要包含一些特殊的私有的东西,比如个人私钥。」 通常来说呢,请求方会把「数字签名和报文原文」一并发送给接收方。
接收方拿到原始报文和数字签名后,用「同一个Hash函数」从报文中生成摘要A。另外,用对方提供的公钥对数字签名进行解密,得到摘要B,对比A和B是否相同,就可以得知报文有没有被篡改过。
如下使用Egg.js示例代码
// 获取签名
router.post('/api/sign/signature', controller.sign.signature);
// 验证签名
router.post('/api/sign/verifySign', controller.sign.verifySign);
### 将报文生成签名返回示例POST Http://localhost:7001/api/sign/signature HTTP/1.1
content-type: application/JSON; charset=utf-8
{
"name": "dss",
"age": 10
}
### 将签名后的报文及相关参数去验证签名
POST http://localhost:7001/api/sign/verifySign HTTP/1.1
content-type: application/json; charset=utf-8
{
"name": "dss",
"age": "10",
"timestamp": "1658732565",
"nonce": "emjlwsezdMQ",
"appid": "11111",
"params": "name=dss&age=10",
"signature": "XXXXX"
}
module.exports = class SignController extends Controller {
async signature(ctx) {
try {
const pageData = ctx.request.body || '';
const startTime = new Date();
// 将报文生成签名
const result = await ctx.service.sign.signature(pageData);
ctx.logger.info(`sign: ${pageData.name}用时:${Date.now() - startTime}ms`);
ctx.body = result;
} catch (error) {
ctx.logger.error(`signature失败:${error.message}`);
return {
...getCodeMsg('signErr', { responseMsg: error.message }),
data: ''
};
}
}
async verifySign(ctx) {
ctx.body = 'verifySign';
}
};
const Service = require('egg').Service;
const qs = require('qs');
const debug = require('debug')('app: SignService');
const {
verifySign,
raw,
getSign,
geTKEypair,
signature,
createTimestamp,
createNonceStr
} = require('../common/utils/sign');
module.exports = class SignService extends Service {
async signature(params) {
const { ctx } = this;
const keypair = getKeypair();
const publicKey = keypair.publicKey;
const privateKey = keypair.privateKey;
debug(`publicKey:${publicKey}`);
debug(`privateKey:${privateKey}`);
// 密钥
const secret = 'kuaida-service';
// 针对不同的调用方分配不同的appid
const appid = '5000';
const args = {
// 生成签名的时间戳
timestamp: createTimestamp(),
// 生成签名的随机串
nonce: createNonceStr(),
// 密钥
secret: secret,
// 授权调用方唯一标识
appid: appid,
// 请求报文
params: qs.stringify(params)
};
const msg = raw(args);
// 加签
const sign = signature(msg, privateKey);
args.signature = sign;
// const vv = verifySign(msg, sign, publicKey);
debug(`args: ${JSON.stringify(args)}`);
// debug(`vv:${vv}`);
return args;
}
};
common/utils/sign/sign.js
// API 接口签名验证
// 请求身份是否合法?
// 请求参数是否被篡改?
// 请求是否唯一
// timestamp+nonce方案: nonce指唯一的随机字符串,用来标识每个被签名的请求,timestamp是否在1分钟内
const sm2 = require('sm-crypto').sm2;
const crypto = require('crypto');
const publicKey = ''; //keypair.publicKey // 公钥
const privateKey = ''; //keypair.privateKey // 私钥
exports.signature = function (msg, privateKey) {
const sigValueHex = sm2.doSignature(msg, privateKey, { hash: true, der: true });
return sigValueHex;
};
// sha1加密
exports.getSign = function (str) {
let shasum = crypto.createHash('sha1');
shasum.update(str);
str = shasum.digest('hex');
return str;
};
exports.verifySign = function (msg, vSign, publicKey) {
const verifyResult = sm2.doVerifySignature(msg, vSign, publicKey, { hash: true, der: true });
return verifyResult;
};
exports.getKeypair = function () {
return sm2.generateKeyPairHex('kuaida-service');
};
exports.createNonceStr = function () {
return Math.random().toString(36).substring(2, 15);
};
exports.createTimestamp = function () {
return parseInt(new Date().getTime() / 1000).toString();
};
exports.raw = function (params) {
// 字典排序
var keys = Object.keys(params);
keys = keys.sort();
var newArgs = {};
keys.forEach(function (key) {
newArgs[key.toLowerCase()] = params[key];
});
var string = '';
for (var k in newArgs) {
string += '&' + k + '=' + newArgs[k];
}
string = string.substring(1);
return string;
};
签名中间件,Sign Middleware
egg中间件配置
config.default.js
exports.middleware = ['signature'];
exports.signature = { path: [/^\/api\/sign\/verifySign\/*/, /^\/uploads/] };
const debug = require('debug')('app: SignMiddleware');
const { verifySign, getKeypair, raw } = require('../common/utils/sign');
module.exports = (options) => {
return async function signature(ctx, next) {
const path = options.path;
const isPath = path && Array.isArray(path);
if (!isPath) {
return;
}
const matchPath = path.some((item) => item.test(ctx.path));
// 需要验签
if (matchPath) {
const keypair = getKeypair();
const publicKey = keypair.publicKey;
const secret = 'kuaida-service';
const appid = '5000';
const { timestamp, nonce, params, signature } = ctx.request.body;
const msg = {
timestamp: timestamp,
nonce: nonce,
secret: secret,
appid: appid,
params: params
};
const str = raw(msg);
const verify = verifySign(str, signature, publicKey);
if (verify) {
await next();
} else {
ctx.body = '验签失败';
}
} else {
await next();
}
};
};
参考质料:
如何设计一个安全的接口
到此这篇关于nodejs环境Eggjs加签验签示例的文章就介绍到这了,更多相关nodejs Eggjs加签验签内容请搜索编程网以前的文章或继续浏览下面的相关文章希望大家以后多多支持编程网!
--结束END--
本文标题: Nodejs环境Eggjs加签验签示例代码
本文链接: https://www.lsjlt.com/news/165227.html(转载时请注明来源链接)
有问题或投稿请发送至: 邮箱/279061341@qq.com QQ/279061341
下载Word文档到电脑,方便收藏和打印~
2024-01-12
2023-05-20
2023-05-20
2023-05-20
2023-05-20
2023-05-20
2023-05-20
2023-05-20
2023-05-20
2023-05-20
回答
回答
回答
回答
回答
回答
回答
回答
回答
回答
0