php-app開發(fā)接口加密詳解

/**
inc 
解析接口
客戶端接口傳輸規(guī)則:
1.用cmd參數(shù)(base64)來動(dòng)態(tài)調(diào)用不同的接口,接口地址統(tǒng)一為 http://a.lovexpp.com
2.將要傳過來的參數(shù)組成一個(gè)數(shù)組，數(shù)組添加timestamp元素(當(dāng)前時(shí)間戳,精確到秒)，將數(shù)組的鍵值按照自然排序從大到小排序
3.將數(shù)組組成 key=valkey=val的形式的字符串，將字符串與XPP_KEY連接在一起,用md5加密一次(32位小寫),得到sign
4.將sign添加到參數(shù)數(shù)組中
5.將參數(shù)數(shù)組轉(zhuǎn)換成json用post請(qǐng)求請(qǐng)求接口地址,key值為param
服務(wù)端接口解析規(guī)則:
1.接收參數(shù)param,將結(jié)果解析json得到參數(shù)數(shù)組
2.取出sign,去掉參數(shù)數(shù)組中的sign
3.將參數(shù)數(shù)組key值按照自然排序從大到小排序
4.將排序后的參數(shù)數(shù)組按照key=valkey=val的形式組成字符串，將字符串與XPP_KEY連接，用md5加密一次(32位小寫)，得到sign
5.將sign與客戶端傳過來的sign進(jìn)行比對(duì),如不一樣則可能是中途被篡改參數(shù)，服務(wù)器拒絕此次請(qǐng)求
6.將sign與session中的sign對(duì)比，如果一樣，則為重復(fù)提交，服務(wù)器拒絕此次請(qǐng)求
7.此次的sign存入session
8.執(zhí)行路由cmd(base64解析后),將參數(shù)帶到該方法中
*/
 
$xpp_key = "xxx";
 
//接收參數(shù)param,將結(jié)果解析json得到參數(shù)數(shù)組
$param = json_decode($_POST['param'] , true);
 
//取出sign,去掉參數(shù)數(shù)組中的sign
$client_sign = $param['sign'];
unset($param['sign']);
 
//將參數(shù)數(shù)組key值按照自然排序從大到小排序
krsort($param);
 
//將排序后的參數(shù)數(shù)組按照key=valkey=val的形式組成字符串，將字符串與XPP_KEY連接，用md5加密一次(32位小寫)，得到sign
$sb = '';
foreach($param as $key=>$val){
  $sb .= $key . '=' . $val . '';
}
$sb .= $xpp_key;
$server_sign = md5($sb);
 
//將sign與客戶端傳過來的sign進(jìn)行比對(duì),如不一樣則可能是中途被篡改參數(shù)，服務(wù)器拒絕此次請(qǐng)求
if($server_sign !== $client_sign){
  echo json_encode(array('code'=>'invalid request'));
  exit;
}
 
//將sign與session中的sign對(duì)比，如果一樣，則為重復(fù)提交，服務(wù)器拒絕此次請(qǐng)求
if($server_sign == $_SESSION['last_sign']){
  echo json_encode(array('code'=>'Repeated requests'));
  exit();
}
 
//此次的sign存入session
$_SESSION['last_sign'] = $server_sign;
 
//執(zhí)行路由cmd(base64解析后),將參數(shù)帶到該方法中
$cmd = base64_decode($param['cmd']);
list($__controller,$__action) = explode('-' , $cmd);
 
// 設(shè)置請(qǐng)求參數(shù)
unset($param['cmd']);
unset($param['timestamp']);
foreach($param as $key => $val){
  $_REQUEST[$key] = $val;
}

package com.xpplove.newxpp.activity;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.TreeMap;
import org.apache.commons.codec.binary.Base64;
import android.os.Bundle;
import com.alibaba.fastjson.JSON;
import com.xpplove.newxpp.BaseActivity;
import com.xpplove.newxpp.bean.Params;
import com.xpplove.newxpp.net.NetPostTask;
import com.xpplove.newxpp.utils.DensityUtil;
public class TestActivity extends BaseActivity {
  private String url = "http://c.lovexpp.com/";
  @Override
  protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    loadMesage();
  }
  private void loadMesage() {
    Base64 base64 = new Base64();
    MapString, String> paramsMap = new HashMapString, String>();
    paramsMap.put("timestamp", (System.currentTimeMillis() / 1000 + ""));
    String cmd = new String(base64.encode("user-camList".getBytes()));
    String dcmd = new String(base64.decode(cmd.getBytes()));
    paramsMap.put("cmd", cmd);
    paramsMap.put("sign", getString(paramsMap));
    String str = getKeyValues(paramsMap);
    paramsMap = new HashMapString, String>();
    paramsMap.put("param", str);
    Params params = new Params();
    params.listener = this;
    params.url = url;
    //new NetWorkTask().executeProxy(params);
    new NetPostTask(paramsMap).executeProxy(params);
  }
  @Override
  public void onGetResult(int errorCode, Object result) {
    super.onGetResult(errorCode, result);
    System.out.println();
  }
  private String getString(MapString, String> paramsMap) {
    TreeMap tm = new TreeMap(paramsMap);
    Iterator i = tm.descendingMap().entrySet().iterator();
    StringBuffer buffer = new StringBuffer();
    while (i.hasNext()) {
      buffer.append(i.next() + "");
    }
    buffer.append(AppKey);
    return DensityUtil.MD5(buffer.toString());
  }
  // 得到鍵值對(duì)
  private String getKeyValues(MapString, String> paramsMap) {
    TreeMap tm = new TreeMap(paramsMap);
    Iterator i = tm.descendingKeySet().iterator();
    String jsonText = JSON.toJSONString(tm.descendingMap(), true);
    return jsonText;
  }
}