webapi服務端對接app

時間 2019-11-20

標籤 webapi 服務對接 app 简体版

原文原文鏈接

目前移動端流行，本文章主要介紹本人（新手）開發與app對接服務端進行分享。不足之處請指正web

與app對接通常的站點接口需映射外網（即外部網絡能夠直接訪問該接口項目），那麼這就要考慮到項目的數據保密性和一些驗證。數據庫

目前我作的接口中所用到了以下技術：json

1：數據的加密/解密：數據在傳輸過程當中須要進行加解密操做纔能有效的保護數據的安全性（個人項目中採用.net framwork 自帶的aes 加解密）api

數據加密可採用自定的加密方式（如 AES DES ）等這裏就不貼代碼了。安全

2：簽名驗證：即 app端將數據進行不可逆加密而後放在http請求的header中，服務端獲取到數據採用相同的不可逆加密方式進行得到密文，將app的密文和服務端解析的密文進行匹配（可在必定程度上保護數據不被篡改）服務器

3：時間戳驗證：app端在http請求中加入時間戳數據，服務端獲取時間戳，去驗證 app的時間戳與服務器端設定的時間戳，防止重放攻擊網絡

4：登陸時效驗證：在每次登陸時產生一個惟一的token驗證碼存儲在數據庫中，並將該 token返回至APP ，app每次請求數據去驗證 token是否已過期，若是過期從新登陸app

在項目開發過程當中對於以上的驗證建議統一處理dom

1：在請求數據進入時統一進行參數的解密和驗證異步

　　方法：統一解密 webapi 項目能夠繼承類 MessageProcessingHandler 並重寫 ProcessRequest 和 ProcessResponse 方法

　　在該ProcessRequest 方法中進行數據的解密

　　在該ProcessResponse 方法中進行數據的加密

2.數據驗證繼承類 DelegatingHandler ，並重寫 SendAsync 方法進行數據的相關驗證，通常若是驗證經過結果直接 return base.SendAsync(request, token); 即最終的效果爲將消息分發到對應的接口中進行處理

若是驗證不經過可直接採用以下方式直接返回信息

/// <summary>
/// 返回客戶端錯誤信息
/// </summary>
/// <param name="request">http請求</param>
/// <param name="needEncrypt">是否加密響應信息</param>
/// <param name="errorMessage">錯誤信息</param>
/// <returns>
/// 異步方式返回的錯誤消息
/// </returns>
private Task<HttpResponseMessage> GenerateErrorResponse(HttpRequestMessage request,
bool needEncrypt,
string errorMessage = "請求參數錯誤")
{
// 記錄錯誤的請求日誌
LogErrorRequest(request);

// 生成錯誤響應消息
var response = new HttpResponseMessage();
var error = JsonConvert.SerializeObject(new ApiResult() { Message = errorMessage });
response.Content = new StringContent(error, Encoding.GetEncoding("UTF-8"), "application/json");
response.StatusCode = System.Net.HttpStatusCode.OK;
if(needEncrypt)
response.Content.Headers.Add("toencrypt", "");

return Task<HttpResponseMessage>.Factory.StartNew(() => response);
}

下面就到代碼 showTime: 如下兩個類建立以後在 global 中註冊便可

/// <summary>
    /// 處理請求參數和響應消息的加解密
    /// </summary>
    public class MessageHandler : MessageProcessingHandler
    {
        #region Private Fields & Const

        private readonly TelemetryClient _client;

        #endregion

        #region Constructor

        /// <summary>
        /// Constructor
        /// </summary>
        public MessageHandler()
        {
            _client = new TelemetryClient();
        }

        #endregion


        #region Override Methods

        /// <summary>
        /// 處理request
        /// 一、消息解密
        /// </summary>
        /// <param name="request">Http 請求</param>
        /// <param name="cancellationToken">cancellation token</param>
        /// <returns>處理後的http request</returns>
        protected override HttpRequestMessage ProcessRequest(HttpRequestMessage request, 
                                                             CancellationToken cancellationToken)
        {
            // 過濾swagger請求
            if (request.RequestUri.Segments.Contains("swagger"))
                return request;

            try
            {
                var method = request.Method.Method.ToLowerInvariant();
                if ("get" == method || "delete" == method)
                {
                    if (request.RequestUri.Query.Length <= 0)
                        return request;

                    var encryptedStr = request.RequestUri.Query?.Substring(1, request.RequestUri.Query.Length - 1);
                    if (!string.IsNullOrEmpty(encryptedStr))
                    {
                        var parameters = HandlerUtility.AES128Decrypt(encryptedStr);
                        var url = $"{request.RequestUri.AbsoluteUri.Split('?')[0]}?{ parameters }";
                        request.RequestUri = new Uri($"{request.RequestUri.AbsoluteUri.Split('?')[0]}?{ parameters }");
                    }
                }
                else
                {

 /// <summary>
    /// Message handler to validate and decrypt request parameter
    /// </summary>
    public class AuthenticationHandler : DelegatingHandler
    {
        #region Private Fields

        private readonly TelemetryClient _client;

        #endregion

        #region Constructor

        /// <summary>
        /// Constructor
        /// </summary>
        public AuthenticationHandler()
        {
            _client = new TelemetryClient();
        }

        #endregion

        #region Override Methods

        /// <summary>
        /// 驗證請求參數
        /// </summary>
        /// <param name="request">http請求</param>
        /// <param name="token">cancellation token</param>
        /// <returns>
        /// HttpResponseMessage
        /// </returns>
        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
                                                               CancellationToken token)
        {


            try
            {
                // 檢查時間戳
                 if (!CheckTimestamp(request.Headers))
                     return GenerateErrorResponse(request, true);

                // 檢查簽名
                 var parameters = GetParameters(request);
                 if (!CheckSignature(request.Headers, parameters))
                     return GenerateErrorResponse(request, true);
            }
            catch (Exception ex)
            {
               
                return GenerateErrorResponse(request, true, "請求失敗！");
            }

            return base.SendAsync(request, token);
        }

        #endregion

        #region Private Methods


        /// <summary>
        /// 獲取請求參數
        /// </summary>
        /// <param name="request">http 請求</param>
        /// <returns>請求參數</returns>
        private static string GetParameters(HttpRequestMessage request)
        {
            if (request == null)
                return string.Empty;

            string parameters = null;
            if ("get".Equals(request.Method.Method, StringComparison.InvariantCultureIgnoreCase) ||
                "delete".Equals(request.Method.Method, StringComparison.InvariantCultureIgnoreCase))
            {
                if (!string.IsNullOrEmpty(request.RequestUri.OriginalString) &&
                   request.RequestUri.OriginalString.Length > 1)
                {
                    var urlArray = request.RequestUri.OriginalString.Split('?');
                    if (urlArray != null && urlArray.Length > 1)
                        parameters = urlArray[1];
                }
            }
            else
            {
                // post/put/delete
                parameters = request.Content.ReadAsStringAsync().Result;
            }

            return parameters;
        }

        /// <summary>
        /// 返回客戶端錯誤信息
        /// </summary>
        /// <param name="request">http請求</param>
        /// <param name="needEncrypt">是否加密響應信息</param>
        /// <param name="errorMessage">錯誤信息</param>
        /// <returns>
        /// 異步方式返回的錯誤消息
        /// </returns>
        private Task<HttpResponseMessage> GenerateErrorResponse(HttpRequestMessage request,
                                                                bool needEncrypt,
                                                                string errorMessage = "請求參數錯誤")
        {
            // 記錄錯誤的請求日誌
            LogErrorRequest(request);

            // 生成錯誤響應消息
            var response = new HttpResponseMessage();
            var error = JsonConvert.SerializeObject(new ApiResult() { Message = errorMessage });
            response.Content = new StringContent(error, Encoding.GetEncoding("UTF-8"), "application/json");
            response.StatusCode = System.Net.HttpStatusCode.OK;
            if(needEncrypt)
                response.Content.Headers.Add("toencrypt", "");

            return Task<HttpResponseMessage>.Factory.StartNew(() => response);
        }

        /// <summary>
        /// 驗證錯誤的請求記錄日誌
        /// </summary>
        /// <param name="request">http請求</param>
        private void LogErrorRequest(HttpRequestMessage request)
        {
            if (request == null)
                return;

            // 記錄請求參數
            var method = request.Method.Method.ToLowerInvariant();
            if ("get" == method || "delete" == method)
            {
                //記錄下相關日誌   以備查看
            }
            else
            {
                request.Content.ReadAsStreamAsync().Result.Seek(0, SeekOrigin.Begin);
                var body = request.Content.ReadAsStringAsync().Result;

            }


        }

        /// <summary>
        /// 驗證時間戳
        /// </summary>
        /// <param name="headers">請求頭信息</param>
        /// <returns>
        /// true表示驗證成功
        /// false表示驗證失敗
        /// </returns>
        private static bool CheckTimestamp(HttpRequestHeaders headers)
        {
            if (headers == null)
                return false;

            long timestamp = 0;
            if (headers.Contains("timestamp"))
                long.TryParse(headers.GetValues("timestamp").FirstOrDefault(), out timestamp);

            // 請求URL的有效期爲15分鐘，防止重放攻擊
            return GetTotalMillisecondsSince1970() - timestamp < 15 * 60 * 1000;
        }

        /// <summary>
        /// 驗證簽名
        /// </summary>
        /// <param name="headers">請求頭信息</param>
        /// <param name="parameters">
        /// 解密後的請求參數
        /// 對於get/delete請求，parameter爲querystring
        /// 對於post/put/patch, paramters爲json字符串
        /// </param>
        /// <returns>
        /// true 表示驗證成功
        /// false表示驗證失敗
        /// </returns>
        private static bool CheckSignature(HttpRequestHeaders headers, string parameters)
        {
            if (headers == null ||
               !headers.Contains("sign") ||
               !headers.Contains("timestamp") ||
               !headers.Contains("random"))
                return false;

            // 客戶端傳過來的簽名
            var sign = headers.GetValues("sign")?.FirstOrDefault();

            // 服務器從新計算簽名
            string computedSign = null;
            var timestamp = headers.GetValues("timestamp")?.FirstOrDefault();
            var random = headers.GetValues("random")?.FirstOrDefault();
            computedSign = HandlerUtility.SHA256Encode(parameters + timestamp + random);

            // 簽名不一致，參數被篡改
            var base64Sign = sign.Replace("$", "+").Replace("*", "=");
            return string.Equals(base64Sign, computedSign, StringComparison.InvariantCulture);
        }


        #endregion
    }

// post/put/patch var encryptedStr = request.Content.ReadAsStringAsync().Result; if (!string.IsNullOrEmpty(encryptedStr)) { var parameters = HandlerUtility.AES128Decrypt(encryptedStr);//加解密自定義方法 request.Content = new StringContent(parameters); request.Content.Headers.ContentLength = parameters.Length; request.Content.Headers.ContentType = new MediaTypeHeaderValue("application/json"); } } } catch (Exception ex) { _client.TrackException(ex); } return request; } /// <summary> /// 處理response /// 一、消息加密 /// </summary> /// <param name="response">明文響應消息</param> /// <param name="cancellationToken">cancelation token</param> /// <returns>密文響應消息</returns> protected override HttpResponseMessage ProcessResponse(HttpResponseMessage response, CancellationToken cancellationToken) { if (response.Content != null) { var contentType = response.Content.Headers.GetValues("content-type").FirstOrDefault(); if (response.Content.Headers.Contains("toencrypt")) { var plaintext = response.Content.ReadAsStringAsync().Result; response.Content = new StringContent(HandlerUtility.AES128Encrypt(plaintext)); response.Content.Headers.Remove("toencrypt"); } } return response; } #endregion }

相關標籤/搜索

每日一句

每一个你不满意的现在，都有一个你没有努力的曾经。