API認證&SDK&RESTful

時間 2019-12-09

標籤 api 認證 sdk&restful sdk restful 简体版

原文原文鏈接

python API的安全認證

咱們根據pid加客戶端的時間戳進行加密md5(pid|時間戳)獲得的單向加密串，與時間戳，或者其它字段的串的url給服務端。html

服務端接收到請求的url進行分析python

客戶端時間與服務端的時間戳之差若是大於規定的時間好比咱們規定10s，這樣就是屬於過時時間。防止有人黑了url，再次請求能夠用redis
若是上面的時間符合，再判斷列表內是否存在url，若是存在則return，這樣防止有人短期獲取url再次請求，咱們拒絕咱們只接受第一次的
這樣前面的兩個都經過就能夠了。

app.py 服務端的api驗證linux

#!/usr/bin/env python
# -*- coding:utf-8 -*-
import tornado.ioloop
import tornado.web
import hashlib
access_record = [

]

PID_LIST = [
    'qwe',
    'ioui',
    '234s',
]
class MainHandler(tornado.web.RequestHandler):
    def get(self):
        import time
        # 獲取url中所有數據
        pid = self.get_argument('pid', None)
        # 獲取變量
        m5, client_time, i = pid.split('|')

        server_time = time.time()
        # 時間超過10s禁止
        if server_time > float(client_time) + 10:
            self.write('滾')
            return
        # 處理10s內容重複的請求
        if pid in access_record:
            self.write('滾')
            return
        access_record.append(pid)

        pid = PID_LIST[int(i)]
        ramdom_str = "%s|%s" %(pid, client_time)
        h = hashlib.md5()
        h.update(bytes(ramdom_str, encoding='utf-8'))
        server_m5 = h.hexdigest()
        # print(m5,server_m5)
        if m5 == server_m5:
            self.write("Hello, world")
        else:
            self.write('滾')

application = tornado.web.Application([
    (r"/index", MainHandler),
])

if __name__ == "__main__":
    application.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

客戶端拼接urlweb

#!/usr/bin/env python
# -*- coding:utf-8 -*-
import time
import requests
import hashlib

PID = 'qwe'

current_time = time.time()
ramdom_str = "%s|%s" %(PID, current_time)
h = hashlib.md5()
h.update(bytes(ramdom_str, encoding='utf-8'))
UID = h.hexdigest()

q = "%s|%s|0" %(UID, current_time)
url = 'http://127.0.0.1:8888/index?pid=%s' % q
print(url)
ret = requests.get(url)


print(ret.text)

黑客redis

#!/usr/bin/env python
# -*- coding:utf-8 -*-
import requests

ret = requests.get('http://127.0.0.1:8888/index?pid=c2539948caa7b7fe0d00fcd9d75b7574|1474341577.4938722|0')
print(ret.text)

基本的api
升級的api
終極版api

環境：Djanao，django

項目名：api_auto，json

app：apiapi

角色：api端，客戶端，黑客端安全

1.基本的api

【api端】服務器

#api_auto/urls.py
from django.conf.urls import url,include
from django.contrib import admin
from api import urls

urlpatterns = [
    url(r'^admin/', admin.site.urls),
    url(r'^api/', include('api.urls')),
]

#api/urls.py
from django.conf.urls import url
from . import views

import include
urlpatterns = [
    url(r'^asset.html', views.asset),
]

#api/views.py
from django.shortcuts import render,HttpResponse
# Create your views here.

def asset(request):
    print(request.POST)
    return  HttpResponse('api訪問成功')

#輸出，這樣api端就能夠拿到客戶端的數據
<QueryDict: {'k2': ['sssss'], 'k1': ['v1sss']}

【客戶端】

# -*- coding: UTF-8 -*-
#blog:http://www.cnblogs.com/linux-chenyang/

import  requests

data_dict = {
    'k1':'v1sss',
    'k2':'sssss',
}

ret = requests.post(
    url='http://127.0.0.1:8000/api/asset.html',
    data=data_dict,
)

print(ret.text)

#輸出，api段會返回給客戶端一個結果
api訪問成功

2.升級的api

因爲上面這種方法沒有認證，假如任何人均可以發post請求，很不安全，引出下面這種方法，讓客戶端帶個key過來，api端先檢查在不在個人列表裏，不在的話就不容許訪問。

【api端】

#api/views.py

def asset(request):
    app_key_dict = {
        'de3908e1-31c3-4de8-a535-7830cca5a427':{'name':'中共中央國務院','level':10},
        'd7b64313-9e62-4441-9f10-b21288a1431a':{'name':'老男孩教育','level':1},
    }
    agent_app_key= request.GET.get('app_key')
    if agent_app_key in app_key_dict:
        name = app_key_dict[agent_app_key]['name']
        print(name)
        return HttpResponse('api訪問成功！')
    else:
        return  HttpResponse('認證失敗,不能訪問api')

#輸出
[08/Aug/2017 15:48:27] "POST /api/asset.html?app_key=de3908e1-31c3-4de8-a535-7830cca5a427 HTTP/1.1" 200 3
中共中央國務院

【客戶端】

import  requests

app_key = 'de3908e1-31c3-4de8-a535-7830cca5a427'
data_dict = {
    'k1':'v1',
    'k2':'v2',
}

ret = requests.post(
    url='http://127.0.0.1:8000/api/asset.html',
    params={'app_key':app_key},
    data=data_dict,
)

print(ret.text)

這種方法有個弊端，假如黑客經過抓包或者其餘方法獲取到服務器的url，那麼客戶端依然能夠訪問。

【黑客端】

import  requests

data_dict = {
    'k1':'v1sss',
    'k2':'sssss',
}

ret = requests.post(
    url='http://127.0.0.1:8000/api/asset.html?app_key=de3908e1-31c3-4de8-a535-7830cca5a427',
    data=data_dict,
)

print(ret.text)

3.終極版api

【api端】

#api/views.py

def asset2(request):
    '''
    用於驗證3的加密匹配
    :param request:
    :return:
    '''
    def create_md5(app_key,app_secret,timestamp):
        import hashlib
        m = hashlib.md5(bytes(app_secret,encoding='utf-8'))
        temp = "%s|%s" %(app_key,timestamp,)
        m.update(bytes(temp,encoding='utf-8'))
        return m.hexdigest()

    '''
    api端存放的客戶段的key
    '''
    app_key_dict = {
        '66244932-3a61-48c5-b847-9a750ba6567e':
            {
                'name':'中共中央國務院',
                'level': 10,
                'secret': 'asd=asdfkdf',
                'record': [
                    {'sign': '3a8530132a55512c9937c60df63ba868','timestamp': 1494042557.7139883}
                ]
            },
        '49684626-71fc-450a-b2bb-dfde77d2cbd3': {'name':'老男孩教育','level': 1,'secret': 'as2dasdf=asdf','record': []},
    }

    """
    從客戶發來的url後拿到所須要的數據，key
    """
    agent_app_key = request.GET.get('app_key')
    agent_app_sign = request.GET.get('app_sign')
    agent_app_timestamp = float(request.GET.get('app_timestamp'))

    """
    驗證1.判斷祕鑰app_key正不正確
    """
    if agent_app_key not in app_key_dict:
        return HttpResponse('二貨，一壘都上不了...')

    """
    驗證2.客戶端過來的key和服務器端之間時間不超過5秒
    """
    server_timestamp = time.time()
    if (server_timestamp - 5) > agent_app_timestamp:
        return HttpResponse('滾，時間怎麼這麼長...')

    """
    驗證3.反解密，匹配加密的key是否正確，secret從api端拿
    """
    server_sign = create_md5(agent_app_key,app_key_dict[agent_app_key]['secret'],agent_app_timestamp)
    if agent_app_sign != server_sign:
        return HttpResponse('小樣，你還給我修改url，太嫩了...')

    """
    驗證4.有了一個訪問的客戶端，一樣的key在不能訪問
    """
    record_list = app_key_dict[agent_app_key]['record']
    for item in record_list:
        if agent_app_sign == item['sign']:
            return HttpResponse('煞筆，來晚了...')

    app_key_dict[agent_app_key]['record'].append({'sign': agent_app_sign,'timestamp': agent_app_timestamp})

    # 數據加密 rsa
    # http://www.cnblogs.com/wupeiqi/articles/6746744.html

    name = app_key_dict[agent_app_key]['name']
    return HttpResponse(name)

api端

import  requests,time
def god2():
    """
    app_sign:這樣就根據app_key+app_secret+timestamp生成動態的字符串
    :return:
    """
    def create_md5(app_key,app_secret,timestamp):
        import hashlib
        m = hashlib.md5(bytes(app_secret,encoding='utf-8'))
        temp = "%s|%s" %(app_key,timestamp,)
        m.update(bytes(temp,encoding='utf-8'))
        return m.hexdigest()

    app_key = '66244932-3a61-48c5-b847-9a750ba6567e'
    app_secret = "asd=asdfkdf"
    app_timestamp = time.time()
    app_sign = create_md5(app_key,app_secret,app_timestamp)

    """
    api請求：
    加密的app_sign和 app_key還有時間app_timestamp傳到API
    可是app_secret不能傳過去
    params：數據會存在url後面？app_sign=****&app_key=***

    """
    data_dict = {
        'k1':'v1',
        'v2':'v2'
    }
    ret = requests.post(
        url='http://127.0.0.1:8000/api/asset2.html',
        params={'app_sign': app_sign,"app_key": app_key, 'app_timestamp': app_timestamp},
        data=data_dict
    )
    print(ret.text)


def god1():
    app_key = 'de3908e1-31c3-4de8-a535-7830cca5a427'
    data_dict = {
        'k1': 'v1',
        'k2': 'v2',
    }

    ret = requests.post(
        url='http://127.0.0.1:8000/api/asset.html',
        params={'app_key': app_key},
        data=data_dict,
    )

    print(ret.text)

if __name__ == '__main__':
    #god1()
    god2()