115 lines
3.2 KiB
Go
115 lines
3.2 KiB
Go
// Package utility 安全请求，思路来源https://blog.csdn.net/David_jiahuan/article/details/106391956
|
||
// @Author 铁憨憨[cory] 2024/9/11 9:38:00
|
||
package utility
|
||
|
||
import (
|
||
"crypto/md5"
|
||
"crypto/sha256"
|
||
"encoding/hex"
|
||
"github.com/gogf/gf/v2/frame/g"
|
||
"github.com/gogf/gf/v2/net/ghttp"
|
||
"github.com/gogf/gf/v2/os/gctx"
|
||
"github.com/gogf/gf/v2/util/gconv"
|
||
"math/big"
|
||
"strconv"
|
||
"time"
|
||
)
|
||
|
||
// 签名验证中间件
|
||
func SignatureMiddleware(r *ghttp.Request) {
|
||
if r.URL.Path == "/zm/api/wxApplet/wxApplet/appPort/releaseAppVersion" {
|
||
r.Middleware.Next()
|
||
return
|
||
}
|
||
// 获取请求中的参数
|
||
signature := gconv.String(r.Header.Get("sign"))
|
||
timestamp := gconv.Int64(r.Header.Get("timestamp"))
|
||
nonce := gconv.String(r.Header.Get("nonce"))
|
||
if signature == "" || timestamp == 0 || nonce == "" {
|
||
r.Response.WriteJson(g.Map{"error": "无效验证"})
|
||
r.ExitAll()
|
||
return
|
||
}
|
||
//验证时间戳
|
||
if !validateTimestamp(timestamp) {
|
||
r.Response.WriteJson(g.Map{"error": "请求过期"})
|
||
r.ExitAll()
|
||
return
|
||
}
|
||
// 验证 nonce 防止重放攻击
|
||
if !validateNonce(nonce) {
|
||
r.Response.WriteJson(g.Map{"error": "无效请求:检测到重放"})
|
||
r.ExitAll()
|
||
return
|
||
}
|
||
serverSignature := generateServerSignature(strconv.FormatInt(timestamp, 10), nonce)
|
||
// 验证签名
|
||
if signature != serverSignature {
|
||
r.Response.WriteJson(g.Map{"error": "签名错误"})
|
||
r.ExitAll()
|
||
return
|
||
}
|
||
//签名验证通过
|
||
r.Middleware.Next()
|
||
}
|
||
|
||
func validateTimestamp(unixTimestamp int64) bool {
|
||
// 获取当前时间
|
||
now := time.Now().UnixMilli()
|
||
result := subtractBigFromInt64(now, unixTimestamp)
|
||
// 将整数 1500 转换为 *big.Int 类型
|
||
big1500 := big.NewInt(30000)
|
||
// 验证时间差是否在 1500 毫秒内
|
||
if result.Cmp(big1500) == -1 && result.Cmp(big.NewInt(0)) >= 0 {
|
||
return true
|
||
}
|
||
return false
|
||
}
|
||
|
||
func subtractBigFromInt64(currentMillis int64, unixTimestamp int64) *big.Int {
|
||
// 将两个 int64 类型的值转换为 *big.Int 类型
|
||
bigCurrent := big.NewInt(currentMillis)
|
||
bigUnixTimestamp := big.NewInt(unixTimestamp)
|
||
// 计算差值
|
||
result := big.NewInt(0).Sub(bigCurrent, bigUnixTimestamp)
|
||
// 求差值的绝对值
|
||
return result.Abs(result)
|
||
}
|
||
|
||
// 验证 nonce
|
||
func validateNonce(nonce string) bool {
|
||
nonceKey := "reset" + nonce
|
||
// 使用 Redis 来存储 nonce，防止重放
|
||
redisClient := g.Redis()
|
||
ctx := gctx.New()
|
||
exists, err := redisClient.Exists(ctx, nonceKey)
|
||
if err != nil {
|
||
return false
|
||
}
|
||
if exists > 0 {
|
||
return false // nonce 已经存在，说明是重放请求
|
||
}
|
||
// nonce 不存在，存储到 Redis 并设置60秒过期时间
|
||
err = redisClient.SetEX(ctx, nonceKey, nonce, 60)
|
||
if err != nil {
|
||
return false
|
||
} else {
|
||
return true
|
||
}
|
||
}
|
||
|
||
// 生成服务端签名
|
||
func generateServerSignature(timestamp, nonce string) string {
|
||
sum := md5.Sum([]byte("coyrOrtiehanhan1223202409111457"))
|
||
md5Sum := hex.EncodeToString(sum[:])
|
||
// 拼接时间戳、nonce 和 secretKey
|
||
signStr := md5Sum + timestamp + nonce
|
||
// 对拼接后的字符串进行 MD5 加密
|
||
md5Hash := md5.Sum([]byte(signStr))
|
||
md5Hex := hex.EncodeToString(md5Hash[:])
|
||
// 对 MD5 结果进行 SHA-256 加密
|
||
sha256Hash := sha256.Sum256([]byte(md5Hex))
|
||
sha256Hex := hex.EncodeToString(sha256Hash[:])
|
||
return sha256Hex
|
||
}
|