SpringBoot实现防篡改防重放的操作步骤

# 使用Spring Initializr快速创建项目
mvn archetype:generate -DgroupId=com.example -DartifactId=SecureAPI -DarchetypeArtifactId=maven-archetype-quickstart -DinteractiveMode=false
cd SecureAPI

<dependencies>
    <!-- Spring Web -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <!-- Redis -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-redis</artifactId>
    </dependency>
    <!-- Hmac加密 -->
    <dependency>
        <groupId>commons-codec</groupId>
        <artifactId>commons-codec</artifactId>
        <version>1.16.0</version>
    </dependency>
    <!-- Lombok（简化代码） -->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
</dependencies>

spring:
  redis:
    host: localhost
    port: 6379

// 未加密的接口示例
@RestController
public class UserController {
    @GetMapping("/user")
    public String getUser(@RequestParam String username) {
        return "Hello, " + username; // 黑客可轻易修改username参数！
    }
}

// 未防重放的接口示例
@PostMapping("/transfer")
public String transferMoney(@RequestParam String amount) {
    // 黑客可重复发送请求，多次转账！
    return "Transfer " + amount + "成功！";
}

// 前端生成签名
function generateSign(params, secretKey) {
    // 1. 参数按字典序排序
    const sortedParams = Object.keys(params)
        .sort()
        .map(key => `${key}=${params[key]}`)
        .join('&');
    // 2. 使用HMAC-SHA256生成签名
    const hmac = CryptoJS.HmacSHA256(sortedParams, secretKey);
    return hmac.toString(CryptoJS.enc.Hex);
}

// 示例调用
const params = { username: 'alice', timestamp: Date.now() };
const sign = generateSign(params, 'your-secret-key');

@Component
public class SignatureValidator {
    private final String secretKey = "your-secret-key";

    public boolean validateSignature(HttpServletRequest request) {
        // 1. 获取请求参数和签名
        Map<String, String> params = getParams(request);
        String sign = request.getHeader("Sign");
        // 2. 重新生成签名
        String sortedParams = params.entrySet().stream()
            .sorted(Comparator.comparing(Map.Entry::getKey))
            .map(entry -> entry.getKey() + "=" + entry.getValue())
            .collect(Collectors.joining("&"));
        String generatedSign = HmacUtils.hmacSha256Hex(secretKey, sortedParams);
        // 3. 对比签名
        return sign.equals(generatedSign);
    }

    private Map<String, String> getParams(HttpServletRequest request) {
        Map<String, String> params = new HashMap<>();
        Enumeration<String> paramNames = request.getParameterNames();
        while (paramNames.hasMoreElements()) {
            String paramName = paramNames.nextElement();
            params.put(paramName, request.getParameter(paramName));
        }
        return params;
    }
}

@Component
public class SignatureFilter implements Filter {
    @Autowired
    private SignatureValidator validator;

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
        HttpServletRequest req = (HttpServletRequest) request;
        if (!validator.validateSignature(req)) {
            throw new RuntimeException("签名验证失败！参数被篡改");
        }
        chain.doFilter(request, response);
    }
}

public boolean validateTimestamp(HttpServletRequest request) {
    long currentTime = System.currentTimeMillis();
    long requestTime = Long.parseLong(request.getHeader("Timestamp"));
    // 允许时间差60秒
    return (currentTime - requestTime) <= 60_000;
}

public boolean validateNonce(HttpServletRequest request) {
    String nonce = request.getHeader("Nonce");
    // 使用Redis记录已使用的nonce，有效期60秒
    String key = "nonce:" + nonce;
    if (redisTemplate.hasKey(key)) {
        return false; // 已存在，说明是重放请求
    }
    redisTemplate.opsForValue().set(key, "used", 60, TimeUnit.SECONDS);
    return true;
}

@Component
public class SecurityFilter implements Filter {
    @Autowired
    private RedisTemplate<String, String> redisTemplate;

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
        HttpServletRequest req = (HttpServletRequest) request;
        // 1. 验证签名
        if (!validateSignature(req)) {
            throw new RuntimeException("签名验证失败！");
        }
        // 2. 验证时间戳
        if (!validateTimestamp(req)) {
            throw new RuntimeException("时间戳超时！");
        }
        // 3. 验证nonce
        if (!validateNonce(req)) {
            throw new RuntimeException("重复请求！防重放失败");
        }
        chain.doFilter(request, response);
    }
}

server:
  port: 8443
  ssl:
    key-store: classpath:keystore.p12
    key-store-password: your-password
    key-store-type: PKCS12

keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore keystore.p12 -validity 365

@RestController
public class TransferController {
    @PostMapping("/transfer")
    public String transfer(@RequestParam String amount, @RequestParam String nonce) {
        // 实际转账逻辑（此处省略）
        return "转账" + amount + "元成功！";
    }
}

const params = {
    amount: "1000",
    timestamp: Date.now(),
    nonce: Math.random().toString(36).substr(2)
};
const sign = generateSign(params, 'your-secret-key');

fetch('/transfer', {
    method: 'POST',
    headers: {
        'Sign': sign,
        'Timestamp': params.timestamp,
        'Nonce': params.nonce
    },
    body: new URLSearchParams(params)
});

sudo ntpdate pool.ntp.org

spring:
  redis:
    cluster:
      nodes:
        - 192.168.1.100:6379
        - 192.168.1.101:6379

<TestPlan>
    <ThreadGroup num_threads="1000">
        <HTTPSamplerProxy>
            <HeaderManager>
                <Header>Sign=your-sign</Header>
                <Header>Timestamp=1623456789</Header>
                <Header>Nonce=random-123</Header>
            </HeaderManager>
            <Path>/transfer</Path>
        </HTTPSamplerProxy>
    </ThreadGroup>
</TestPlan>