简介 应用基于HTTP POST或HTTP GET请求发送Open API调用请求时,为了确保应用与REST服务器之间的安全通信,防止Secret Key盗用、数据篡改等恶意攻击行为,REST服务器使用了参数签名机制。应用在调用Open API之前,需要为其所有请求参数计算一个MD5签名,并追
应用基于HTTP POST或HTTP GET请求发送Open API调用请求时,为了确保应用与REST服务器之间的安全通信,防止Secret Key盗用、数据篡改等恶意攻击行为,REST服务器使用了参数签名机制。应用在调用Open API之前,需要为其所有请求参数计算一个MD5签名,并追加到请求参数中,参数名为“sign”。REST服务器在接收到请求时会重新计算签名,并判断其值是否与应用传递过来的sign参数值一致,以此判定当前Open API调用请求是否是被第三者伪造或篡改。
应用在调用Open API之前需要通过 OAuth2.0服务获得用户或平台的授权,获取到授权后将会拿到以下3个重要参数:
其中,session_secret这个参数就是做参数签名时所需要的签名密钥。这与Facebook、人人网等平台稍微有所区别,这两个平台在做参数签名时所用的签名密钥一般有2个:
假设参与参数签名计算的请求参数分别是“k1”、“k2”、“k3”,它们的值分别是“v1”、“v2”、“v3”,则参数签名计算方法如下:
注意:计算签名时的请求参数中不要包含sign(签名)参数,因为sign参数的值此时还不知道,有待计算。
另外,计算签名的时候不需要对参数进行urlencode处理(“application/x-www-form-urlencoded”编码),但是发送请求的时候需要进行urlencode处理,这是很多开发者最容易犯错的地方。
假设某个应用需要获取某个uid为67411167的用户的基本资料,应用在之前的通过OAuth2.0服务获取Access Token的过程中所拿到的session_key和session_secret参数值分别为:
调用Open API时的系统时间(PHP中可以通过date('Y-m-d H:i:s')来获取当前系统时间)为"2011-06-21 17:18:09",希望REST服务器以JSON格式返回调用结果,即相当于参与参数签名计算的请求参数集合为:
<span>[ </span>"session_key" => "9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A="<span>, </span>"timestamp" => "2011-06-21 17:18:09"<span>, </span>"format" => "json"<span>, </span>"uid" => 67411167<span> ]</span>
则计算签名的具体过程如下:
<span> [ </span>"session_key=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A="<span>, </span>"timestamp=2011-06-21 17:18:09"<span>, </span>"format=json"<span>, </span>"uid=67411167"<span> ]</span>
<span> [ </span>"format=json"<span>, </span>"session_key=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A="<span>, </span>"timestamp=2011-06-21 17:18:09"<span>, </span>"uid=67411167"<span> ]</span>
format<span>=</span>jsonsession_key<span>=</span>9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A<span>=</span>timestamp<span>=</span><span>2011</span><span>-</span><span>06</span><span>-</span><span>21</span> <span>17</span><span>:</span><span>18</span><span>:</span>09uid<span>=</span><span>67411167</span>
format<span>=</span>jsonsession_key<span>=</span>9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A<span>=</span>timestamp<span>=</span><span>2011</span><span>-</span><span>06</span><span>-</span><span>21</span> <span>17</span><span>:</span><span>18</span><span>:</span>09uid<span>=</span>6741116727e1be4fdcaa83d7f61c489994ff6ed6
接下来便可以通过HTTP POST方法或HTTP GET方法请求Open API的REST服务器,进行接口调用了,如:
GET /rest/2.0/passport/users/getInfo?session_key=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A%3D×tamp=2011-06-21+17%3A18%3A09&format=json&uid=67411167&sign=d24dd357a95a2579c410b3a92495f009 HTTP/1.1<span> Host: openapi.baidu.com User</span>-<span>Agent: Client of Baidu Open Platform Accept: </span>*<span>/*</span><span> Accept-Encoding: gzip,deflate Accept-Charset: utf-8 Connection: close 或 POST /rest/2.0/passport/users/getInfo HTTP/1.1 Host: openapi.baidu.com User-Agent: Client of Baidu Open Platform Accept: </span><span>*/</span>*<span> Accept</span>-<span>Encoding: gzip,deflate Accept</span>-Charset: utf-8<span> Content</span>-Length: 179<span> Connection: close session_key</span>=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A%3D×tamp=2011-06-21+17%3A18%3A09&format=json&uid=67411167&sign=d24dd357a95a2579c410b3a92495f009
获取签名的PHP代码实现方式如下所示:
<span>/*</span><span>* * 签名生成算法 * @param array $params API调用的请求参数集合的关联数组,不包含sign参数 * @param string $secret 签名的密钥即获取access token时返回的session secret * @return string 返回参数签名值 </span><span>*/</span> <span>function</span> getSignature(<span>$params</span>, <span>$secret</span><span>) { </span><span>$str</span> = ''; <span>//</span><span>待签名字符串 //先将参数以其参数名的字典序升序进行排序</span> <span>ksort</span>(<span>$params</span><span>); </span><span>//</span><span>遍历排序后的参数数组中的每一个key/value对</span> <span>foreach</span> (<span>$params</span> <span>as</span> <span>$k</span> => <span>$v</span><span>) { </span><span>//</span><span>为key/value对生成一个key=value格式的字符串,并拼接到待签名字符串后面</span> <span>$str</span> .= "<span>$k</span>=<span>$v</span>"<span>; } </span><span>//</span><span>将签名密钥拼接到签名字符串最后面</span> <span>$str</span> .= <span>$secret</span><span>; </span><span>//</span><span>通过md5算法为签名字符串生成一个md5签名,该签名就是我们要追加的sign参数值</span> <span>return</span> <span>md5</span>(<span>$str</span><span>); }</span>
调用示例:
<span>$uid</span> = 67411167<span>; </span><span>$params</span> = <span>array</span><span>( </span>"session_key" => "9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A=", "timestamp" => "2011-06-21 17:18:09", "format" => "json", "uid" => <span>$uid</span>,<span> ); </span><span>$sign</span> = getSignature(<span>$params</span>, "27e1be4fdcaa83d7f61c489994ff6ed6");
获取签名的java代码实现方式如下所示:
<span>/**</span><span> * 签名生成算法 * </span><span>@param</span><span> HashMap<string> params 请求参数集,所有参数必须已转换为字符串类型 * </string></span><span>@param</span><span> String secret 签名密钥 * </span><span>@return</span><span> 签名 * </span><span>@throws</span><span> IOException </span><span>*/</span> <span>public</span> <span>static</span> String getSignature(HashMap<string> params, String secret) <span>throws</span><span> IOException { </span><span>//</span><span> 先将参数以其参数名的字典序升序进行排序</span> Map<string string> sortedParams = <span>new</span> TreeMap<string string><span>(params); Set</span><entry string>> entrys =<span> sortedParams.entrySet(); </span><span>//</span><span> 遍历排序后的字典,将所有参数按"key=value"格式拼接在一起</span> StringBuilder basestring = <span>new</span><span> StringBuilder(); </span><span>for</span> (Entry<string string><span> param : entrys) { basestring.append(param.getKey()).append(</span>"="<span>).append(param.getValue()); } basestring.append(secret); </span><span>//</span><span> 使用MD5对待签名串求签</span> <span>byte</span>[] bytes = <span>null</span><span>; </span><span>try</span><span> { MessageDigest md5 </span>= MessageDigest.getInstance("MD5"<span>); bytes </span>= md5.digest(basestring.toString().getBytes("UTF-8"<span>)); } </span><span>catch</span><span> (GeneralSecurityException ex) { </span><span>throw</span> <span>new</span><span> IOException(ex); } </span><span>//</span><span> 将MD5输出的二进制结果转换为小写的十六进制</span> StringBuilder sign = <span>new</span><span> StringBuilder(); </span><span>for</span> (<span>int</span> i = 0; i ) { String hex = Integer.toHexString(bytes[i] & 0xFF<span>); </span><span>if</span> (hex.length() == 1<span>) { sign.append(</span>"0"<span>); } sign.append(hex); } </span><span>return</span><span> sign.toString(); }</span></string></entry></string></string></string>
注意:计算签名时所有参数的key和value都必须先转换为对应的字符串类型,因为在HTTP请求中传递的内容都是字符串类型的,很多开发者都因为没注意到这点,直接将非字符串类型的参数的二进制值传递了进去,结果导致签名与服务端计算的不一致而出错。
获取签名的C#代码实现方式如下所示:
<span>///</span> <span><summary></summary></span> <span>///</span><span> 计算参数签名 </span><span>///</span> <span></span> <span>///</span> <span><param name="params"></span><span>请求参数集,所有参数必须已转换为字符串类型</span><span></span> <span>///</span> <span><param name="secret"></span><span>签名密钥</span><span></span> <span>///</span> <span><returns></returns></span><span>签名</span><span></span> <span>public</span> <span>static</span> <span>string</span> getSignature(IDictionarystring, <span>string</span>> parameters, <span>string</span><span> secret) { </span><span>//</span><span> 先将参数以其参数名的字典序升序进行排序</span> IDictionarystring, <span>string</span>> sortedParams = <span>new</span> SortedDictionarystring, <span>string</span>><span>(parameters); IEnumerator</span><keyvaluepair>string, <span>string</span>>> iterator=<span> sortedParams.GetEnumerator(); </span><span>//</span><span> 遍历排序后的字典,将所有参数按"key=value"格式拼接在一起</span> StringBuilder basestring= <span>new</span><span> StringBuilder(); </span><span>while</span><span> (iterator.MoveNext()) { </span><span>string</span> key =<span> iterator.Current.Key; </span><span>string</span> value =<span> iterator.Current.Value; </span><span>if</span> (!<span>string</span>.IsNullOrEmpty(key) && !<span>string</span><span>.IsNullOrEmpty(value)){ basestring.Append(key).Append(</span><span>"</span><span>=</span><span>"</span><span>).Append(value); } } basestring.Append(secret); </span><span>//</span><span> 使用MD5对待签名串求签</span> MD5 md5 =<span> MD5.Create(); </span><span>byte</span>[] bytes =<span> md5.ComputeHash(Encoding.UTF8.GetBytes(basestring.ToString())); </span><span>//</span><span> 将MD5输出的二进制结果转换为小写的十六进制</span> StringBuilder result = <span>new</span><span> StringBuilder(); </span><span>for</span> (<span>int</span> i = <span>0</span>; i ) { <span>string</span> hex = bytes[i].ToString(<span>"</span><span>x</span><span>"</span><span>); </span><span>if</span> (hex.Length == <span>1</span><span>) { result.Append(</span><span>"</span><span>0</span><span>"</span><span>); } result.Append(hex); } </span><span>return</span><span> result.ToString(); }</span></keyvaluepair>
服务器接受请求后,同样对参数进行签名,如果签名相同则数据没有被修改或者丢失。
注意:计算签名时所有参数的key和value都必须先转换为对应的字符串类型,因为在HTTP请求中传递的内容都是字符串类型的,很多开发者都因为没注意到这点,直接将非字符串类型的参数的二进制值传递了进去,结果导致签名与服务端计算的不一致而出错。