using Coldairarrow.Business.Base_Manage; using Coldairarrow.Util; using
Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc.Filters; using
Microsoft.Extensions.Caching.Distributed; using Microsoft.Extensions.
DependencyInjection; using Microsoft.Extensions.Logging; using System; using
System.Threading.Tasks; namespace Core.Api { /* ==== Signature verification ====
To ensure the safety of the interface , Each request must be accompanied by the following header | header name | type | describe | | appId | string | application Id | | time |
string | current time , The format is :2020-06-29 23:00:00 | | guid | string |
GUID character string , As request unique flag , Prevent duplicate requests | | sign| string | autograph , The signature algorithm is as follows | Example of signature algorithm : order : appId=xxx
appSecret=xxx time=2017-01-01 23:00:00
guid=d0595245-60db-495d-9c0e-fea931b8d69a Requested body={"aaa":"aaa"} 1:
Splicing in turn appId+time+guid+body+appSecret obtain xxx2017-01-01
23:00:00d0595245-60db-495d-9c0e-fea931b8d69a{"aaa":"aaa"}xxx 2:
The above concatenated string is processed MD5(32 position ) You can get the signature sign=MD5(xxx2017-01-01
23:00:00d0595245-60db-495d-9c0e-fea931b8d69a{"aaa":"aaa"}xxx)
=4e30f1eca521485c208f642a7d927ff0 3: stay header Carrying the above appId,time,guid,sign that will do */ ///
<summary> /// Verify signature , Very strict /// non-repudiation , Anti counterfeiting , Prevent duplicate calls /// </summary> public class
CheckSignAttribute : BaseActionFilterAsync { /// <summary> /// Action Before execution ///
</summary> /// <param name="filterContext"></param> public async override Task
OnActionExecuting(ActionExecutingContext filterContext) { // Determine whether signature is required if (
filterContext.ContainsFilter<IgnoreSignAttribute>()) return; var request =
filterContext.HttpContext.Request; IServiceProvider serviceProvider =
filterContext.HttpContext.RequestServices; IBase_AppSecretBusiness appSecretBus
= serviceProvider.GetService<IBase_AppSecretBusiness>(); ILogger logger =
serviceProvider.GetService<ILogger<CheckSignAttribute>>(); var cache =
serviceProvider.GetService<IDistributedCache>(); string appId = request.Headers[
"appId"].ToString(); if (appId.IsNullOrEmpty()) { ReturnError(" lack header:appId");
return; } string time = request.Headers["time"].ToString(); if (time.
IsNullOrEmpty()) { ReturnError(" lack header:time"); return; } if (time.ToDateTime()
< DateTime.Now.AddMinutes(-5) || time.ToDateTime() > DateTime.Now.AddMinutes(5))
{ ReturnError("time be overdue "); return; } string guid = request.Headers["guid"].
ToString(); if (guid.IsNullOrEmpty()) { ReturnError(" lack header:guid"); return; }
string guidKey = $"ApiGuid_{guid}"; if (cache.GetString(guidKey).IsNullOrEmpty()
) cache.SetString(guidKey, "1", new DistributedCacheEntryOptions {
AbsoluteExpirationRelativeToNow= TimeSpan.FromMinutes(10) }); else { ReturnError
(" Prohibit duplicate calls !"); return; } request.EnableBuffering(); string body = await request.
Body.ReadToStringAsync(); string sign = request.Headers["sign"].ToString(); if (
sign.IsNullOrEmpty()) { ReturnError(" lack header:sign"); return; } string appSecret
= await appSecretBus.GetAppSecretAsync(appId); if (appSecret.IsNullOrEmpty()) {
ReturnError("header:appId invalid "); return; } string newSign = HttpHelper.
BuildApiSign(appId, appSecret, guid, time.ToDateTime(), body); if (sign !=
newSign) { string log = $@"sign Signature error ! headers:{request.Headers.ToJson()}
body:{body} correct sign:{newSign} "; logger.LogWarning(log); ReturnError(
"header:sign Signature error "); return; } void ReturnError(string msg) { filterContext.
Result= Error(msg); } } } } namespace Core.Api { /// <summary> /// Ignore interface signature verification ///
</summary> public class IgnoreSignAttribute : BaseActionFilterAsync { } }

Technology
©2019-2020 Toolsou All rights reserved,
Huawei's limited old rivals benefit the most ? More and more people divide the cake !Android 11 Official release !SSM Project's excel File upload and add to database el-select Get selected label value Summary of artificial intelligence algorithm vue vue-element-admin Summary of the project python3 Read the file and specify a few lines , And write to another file ElementUI In the select Of label value Thoughts on multi tenant system stay Vue Use in Web Worker