sign = MD5(按 key 排序后的參數(shù)字符串 + appSecret)

appId=123&nonce=xyz&t=1710001234&data=xxx&appSecret=abcDEF123

String key = "rate_limit:" + normalizedPath + ":" + getClientIp(request);
Long count = redisTemplate.opsForValue().increment(key);
if (count == 1) {
    redisTemplate.expire(key, 10, TimeUnit.SECONDS);
}
if (count > 5) {
    throw new ApiException("請(qǐng)求過于頻繁，請(qǐng)稍后再試");
}

String nonceKey = "nonce_cache:" + appId + ":" + nonce;
Boolean success = redisTemplate.opsForValue().setIfAbsent(nonceKey, "1", 5, TimeUnit.MINUTES);
if (Boolean.FALSE.equals(success)) {
    throw new ApiException("重復(fù)請(qǐng)求被攔截");
}

@Target({ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface ApiSign {
    boolean required() default true;
}

@Component
public class ApiSecurityInterceptor implements HandlerInterceptor {


    @Autowired
    private RedisTemplate<String, String> redisTemplate;


    private static final long EXPIRE_TIME = 5 * 60; // 5分鐘


    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        if (!(handler instanceof HandlerMethod)) return true;


        HandlerMethod method = (HandlerMethod) handler;
        ApiSign apiSign = method.getMethodAnnotation(ApiSign.class);
        if (apiSign == null || !apiSign.required()) return true;


        // 提取參數(shù)
        String appId = request.getParameter("appId");
        String sign = request.getParameter("sign");
        String nonce = request.getParameter("nonce");
        String timestamp = request.getParameter("timestamp");


        if (StringUtils.isAnyBlank(appId, sign, nonce, timestamp)) {
            throw new ApiException("簽名參數(shù)不完整");
        }


        // 校驗(yàn)時(shí)間戳
        long currentTime = System.currentTimeMillis() / 1000;
        if (Math.abs(currentTime - Long.parseLong(timestamp)) > EXPIRE_TIME) {
            throw new ApiException("請(qǐng)求時(shí)間已過期");
        }


        // 重放校驗(yàn)
        String nonceKey = "nonce_cache:" + appId + ":" + nonce;
        if (Boolean.FALSE.equals(redisTemplate.opsForValue().setIfAbsent(nonceKey, "1", EXPIRE_TIME, TimeUnit.SECONDS))) {
            throw new ApiException("重復(fù)請(qǐng)求被拒絕");
        }


        // 簽名驗(yàn)證
        Map<String, String[]> parameterMap = request.getParameterMap();
        String calculatedSign = SignUtils.calculateSign(parameterMap, getAppSecret(appId));
        if (!sign.equalsIgnoreCase(calculatedSign)) {
            throw new ApiException("簽名校驗(yàn)失敗");
        }


        return true;
    }


    private String getAppSecret(String appId) {
        // 實(shí)際項(xiàng)目中建議從數(shù)據(jù)庫(kù)或配置中心加載
        return "secretFor_" + appId;
    }
}

public class SignUtils {


    public static String calculateSign(Map<String, String[]> params, String appSecret) {
        SortedMap<String, String> sortedParams = new TreeMap<>();
        for (Map.Entry<String, String[]> entry : params.entrySet()) {
            if ("sign".equalsIgnoreCase(entry.getKey())) continue;
            sortedParams.put(entry.getKey(), entry.getValue()[0]);
        }


        StringBuilder sb = new StringBuilder();
        for (Map.Entry<String, String> entry : sortedParams.entrySet()) {
            sb.append(entry.getKey()).append("=").append(entry.getValue()).append("&");
        }
        sb.append("appSecret=").append(appSecret);


        return DigestUtils.md5DigestAsHex(sb.toString().getBytes(StandardCharsets.UTF_8)).toUpperCase();
    }
}

@Configuration
public class WebConfig implements WebMvcConfigurer {


    @Autowired
    private ApiSecurityInterceptor apiSecurityInterceptor;


    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(apiSecurityInterceptor)
                .addPathPatterns("/api/**");
    }
}

@GetMapping("/api/secure/data")
@ApiSign
public Result<String> getSecureData() {
    return Result.success("這是簽名驗(yàn)證通過的數(shù)據(jù)");
}