Springboot實(shí)現(xiàn)接口傳輸加解密的步驟詳解

更新時(shí)間：2023年09月27日 11:55:14 作者：qq243920161

這篇文章主要給大家詳細(xì)介紹了Springboot實(shí)現(xiàn)接口傳輸加解密的操作步驟,文中有詳細(xì)的圖文解釋和代碼示例供大家參考,對(duì)大家的學(xué)習(xí)或工作有一定的幫助,需要的朋友可以參考下

前言

先給大家看下效果，原本我們的請(qǐng)求是這樣子的

加密后的數(shù)據(jù)傳輸是這樣子的

如果這是你想要的效果，那么請(qǐng)繼續(xù)往下看

加解密步驟：

1.前端請(qǐng)求前進(jìn)行加密，然后發(fā)送到后端

2.后端收到請(qǐng)求后解密

3.后端返回?cái)?shù)據(jù)前進(jìn)行加密

4.前端拿到加密串后，解密數(shù)據(jù)

加解密算法：

本文用的是國(guó)密算法作為參考，當(dāng)然大家也可以用其它算法進(jìn)行加解密

一、前端請(qǐng)求前進(jìn)行加密，然后發(fā)送到后端

import axios from 'axios';
import { sm2 } from 'sm-crypto';
axios.interceptors.request.use(config => {
	// form-data傳參方式不加密
	if (config.headers['Content-Type'] === 'application/x-www-form-urlencoded') {
		return;
	}
	// 非body方式傳參，不加密
	if (config.data) {
		return;
	}
	// 使用國(guó)密算法進(jìn)行加密
	let encryptData = sm2.doEncrypt(JSON.stringify(config.data), '加密公鑰，請(qǐng)?zhí)崆吧珊?);
	config.data = {
		data: encryptData
	}
});

以上代碼使用了axios攔截器，對(duì)所有請(qǐng)求進(jìn)行攔截，攔截器里，使用config.data獲取到請(qǐng)求的body進(jìn)行加密，加密后，把加密后的數(shù)據(jù)重新賦值到config.data，sm-crypto是國(guó)密算法的依賴，使用前npm install sm-crypto即可

請(qǐng)確保config.data是一個(gè)對(duì)象或者數(shù)組，不要是一個(gè)字符串，否則后端獲取body時(shí)會(huì)失敗

加密成功后，從network就能看到加密的數(shù)據(jù)了

二、后端收到請(qǐng)求后解密

這里有兩個(gè)類直接復(fù)制粘貼即可，一個(gè)是RequestWrapper，這個(gè)類是用來(lái)讀取body的，一個(gè)是BodyRequestWrapper，這個(gè)類是用來(lái)解密后，將解密后的數(shù)據(jù)封裝到request，供Controller層使用，這里直接上代碼了

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.*;
/**
 * 用來(lái)讀取body
 */
public class RequestWrapper extends HttpServletRequestWrapper {
    private final String body;
    public RequestWrapper(HttpServletRequest request) {
        super(request);
        StringBuilder stringBuilder = new StringBuilder();
        BufferedReader bufferedReader = null;
        InputStream inputStream = null;
        try {
            inputStream = request.getInputStream();
            if (inputStream != null) {
                bufferedReader = new BufferedReader(new InputStreamReader(inputStream));
                char[] charBuffer = new char[128];
                int bytesRead = -1;
                while ((bytesRead = bufferedReader.read(charBuffer)) > 0) {
                    stringBuilder.append(charBuffer, 0, bytesRead);
                }
            } else {
                stringBuilder.append("");
            }
        } catch (IOException ex) {
        } finally {
            if (inputStream != null) {
                try {
                    inputStream.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
            if (bufferedReader != null) {
                try {
                    bufferedReader.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
        }
        body = stringBuilder.toString();
    }
    @Override
    public ServletInputStream getInputStream() throws IOException {
        final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(body.getBytes());
        ServletInputStream servletInputStream = new ServletInputStream() {
            @Override
            public boolean isFinished() {
                return false;
            }
            @Override
            public boolean isReady() {
                return false;
            }
            @Override
            public void setReadListener(ReadListener readListener) {
            }
            @Override
            public int read() throws IOException {
                return byteArrayInputStream.read();
            }
        };
        return servletInputStream;
    }
    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(this.getInputStream()));
    }
    public String getBody() {
        return this.body;
    }
}

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
/**
 * 用來(lái)重新封裝request
 */
public class BodyRequestWrapper extends HttpServletRequestWrapper {
    /**
     * 存放JSON數(shù)據(jù)主體
     */
    private String body;
    public BodyRequestWrapper(HttpServletRequest request, String context) {
        super(request);
        body = context;
    }
    @Override
    public ServletInputStream getInputStream() throws IOException {
        final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(body.getBytes("UTF-8"));
        return new ServletInputStream() {
            @Override
            public int read() throws IOException {
                return byteArrayInputStream.read();
            }
            @Override
            public boolean isFinished() {
                return false;
            }
            @Override
            public boolean isReady() {
                return false;
            }
            @Override
            public void setReadListener(ReadListener listener) {
            }
        };
    }
    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(this.getInputStream()));
    }
}

然后我們需要寫一個(gè)請(qǐng)求過(guò)濾器，繼承Filter，對(duì)所有請(qǐng)求接口進(jìn)行過(guò)濾

import com.alibaba.fastjson2.JSON;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import javax.annotation.Resource;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
/**
 * 請(qǐng)求加解密過(guò)濾器
 *
 * @author 猴哥
 */
@Component
public class RequestHandler implements Filter {
	/**
	 * 進(jìn)行請(qǐng)求加密
	 */
	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
		// form-data不校驗(yàn)
		if ("application/x-www-form-urlencoded".equals(request.getContentType())) {
			chain.doFilter(request, response);
			return;
		}
		// 拿到加密串
		String data = new RequestWrapper((HttpServletRequest) request).getBody();
		if (StringUtils.isEmpty(data)) {
			chain.doFilter(request, response);
			return;
		}
		// 解析
		String body = Sm2Util.decrypt("解密私鑰", data);
		request = new BodyRequestWrapper((HttpServletRequest) request, body);
		chain.doFilter(request, response);
	}
}

Sm2Util是國(guó)密的解密方式，工具類在之前分享的帖子里有，當(dāng)然，大家可以用自己喜歡的方式進(jìn)行加解密

這樣就能拿到加密串了

但是有個(gè)問(wèn)題就是，這樣寫的話，所有請(qǐng)求都會(huì)走Filter，但是我們只想讓部分請(qǐng)求走Filter怎么辦呢，寫一個(gè)配置類就可以了，這樣就可以將url進(jìn)行過(guò)濾

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
/**
 * @author 猴哥
 */
@Configuration
public class EncryptionConfiguration {
	/**
	 * 過(guò)濾器配置
	 */
	@Bean
	public FilterRegistrationBean<RequestHandler> filterRegistration(RequestHandler requestHandler) {
		FilterRegistrationBean<RequestHandler> registration = new FilterRegistrationBean<>();
		registration.setFilter(requestHandler);
		registration.addUrlPatterns("/plugin/*");
		registration.setName("encryptionFilter");
		//設(shè)置優(yōu)先級(jí)別
		registration.setOrder(1);
		return registration;
	}
}

以上代碼就是將/plugin開(kāi)頭的url進(jìn)行攔截，代碼不難，就不用過(guò)多解釋了吧

三、后端返回?cái)?shù)據(jù)前進(jìn)行加密

代碼如下

import com.alibaba.fastjson.JSON;
import org.springframework.core.MethodParameter;
import org.springframework.http.MediaType;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.http.server.ServerHttpRequest;
import org.springframework.http.server.ServerHttpResponse;
import org.springframework.stereotype.Component;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.servlet.mvc.method.annotation.ResponseBodyAdvice;
import javax.annotation.Resource;
import java.util.ArrayList;
import java.util.List;
/**
 * 響應(yīng)加解密攔截器
 *
 * @author 猴哥
 */
@Component
@ControllerAdvice
public class ResponseHandler implements ResponseBodyAdvice<Object> {
	/**
	 * 返回true，才會(huì)走beforeBodyWrite方法
	 */
	@Override
	public boolean supports(MethodParameter methodParameter, Class<? extends HttpMessageConverter<?>> aClass) {
		return true;
	}
	/**
	 * 響應(yīng)加密
	 */
	@Override
	public Object beforeBodyWrite(Object body, MethodParameter methodParameter, MediaType mediaType, Class<? extends HttpMessageConverter<?>> aClass, ServerHttpRequest request, ServerHttpResponse serverHttpResponse) {
		// 拿到響應(yīng)的數(shù)據(jù)
		String json = JSON.toJSONString(body);
		// 進(jìn)行加密
		return Sm2Util.encrypt("加密公鑰", json);
	}
}

前端即可拿到這樣一個(gè)加密數(shù)據(jù)

四、前端拿到加密串后，解密數(shù)據(jù)

需要再axios中添加一個(gè)響應(yīng)攔截器，代碼如下

import axios from 'axios';
import { sm2 } from 'sm-crypto';
// 響應(yīng)攔截器
axios.interceptors.response.use(res => {
	res.data = JSON.parse(sm2.doDecrypt(res.data, '解密私鑰'));
	console.log('解密出來(lái)的數(shù)據(jù)', res.data);
});

打印如圖所示