前后端分离数据传输加解密方案(建议方案二)-Toy模板网

这篇具有很好参考价值的文章主要介绍了前后端分离数据传输加解密方案(建议方案二)。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

方案一请求响应参数全部加密

1.优缺点

a.优点：实现简单，比明文传输安全

b.缺点：1)由于加密所有参数，效率低下 2)信息全加密，不利于前后端联调 3)密钥传输不安全，容易被拦截

优化点：前端生成AES对称加密密钥，用rsa私钥非对称加密将AES密钥加密，传给到后端，后端用rsa公钥解密后获取到AES密钥，这样前后端就有了公共的AES密钥了

2.开发步骤（AES对称加密)

加密流程:

a.前端调用接口/web/security/v1/getAesKey 并将其保存在sesssionStrage中

b.后端在前端调用/web/security/v1/getAesKey时，生成AES密钥并保存在session中，并返回给前端

c.前端访问其他接口传入的参数都用此AES密钥加密，接收到的响应数据都用此AES密钥解密，可以拦截器，对所有请求和响应加解密

d.后端和前端一样用此AES密钥进行加解密

前端加解密

<script src="https://cdn.bootcss.com/crypto-js/3.1.9-1/crypto-js.min.js"></script>

/**
* 加密
**/
function encrypt(value,key) {
    var tempValue = JSON.stringify(value);
 var tempKey = CryptoJS.enc.Utf8.parse(key);
 var srcs = CryptoJS.enc.Utf8.parse(tempValue); 
 var encrypted = CryptoJS.AES.encrypt(srcs, key, { mode: CryptoJS.mode.ECB, 
  padding:CryptoJS.pad.Pkcs7 });
  var encryptedValue = encrypted.toString();
   return encryptedValue;
}


/**
*解密
**/
 function decrypt(value,key) {
	var keyStr = CryptoJS.enc.Utf8.parse(key)
    var decrypt = CryptoJS.AES.decrypt(value, keyStr, { mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.Pkcs7 })
    return CryptoJS.enc.Utf8.stringify(decrypt).toString()
 }

b.后端加解密

  public class AesEncrypt {

 /**
     * 加密
     *
     * @param value数据
     * @param key  密钥
     * @return 加密后内容
     */
    public static byte[] encrypt(byte[] value, String key) throw Exception{
            Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
            cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key.getBytes("UTF-8"), "AES"));
            return cipher.doFinal(value);
       
    }

 /**
     * 解密
     *
     * @param value数据
     * @param key  密钥
     * @return 解密后内容
     */
    public static  byte[] decrypt(byte[] value, String key) throw Exception {
  
            Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
            SecretKeySpec secretKeySpec = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
            //使用密钥初始化，设置为解密模式
            cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
            //执行操作
            return cipher.doFinal(value);

        
    }
}

c.后端拦截代码实现

/**
* 请求过滤器，记得注册
**/
public EncryptFilter implements Filter {


 @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
        throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        String uri = request.getRequestURI();
        LOGGER.debug("进入加解密过滤器，URI:{}", uri);
        HttpServletResponse response = (HttpServletResponse) servletResponse;
       AesHttpServletRequestWrapper aesHttpServletRequestWrapper = new AesHttpServletRequestWrapper(request);
        filterChain.doFilter(aesHttpServletRequestWrapper, response);
       
    }


}

/**
* (1)请求拦截，解密
**/
public class AesHttpServletRequestWrapper extends HttpServletRequestWrapper {

     private String bodyContent;
     private Parameters parameters = new Parameters();
     private HttpServletRequest request;

     public AesHttpServletRequestWrapper (HttpServletRequest request) {
    request = request;
    initWrapper();
  }

private void initWrapper() {
      this.parameters.setCharset(charset);
      readBodyBytes();
      this.parseParameterMap();
  }  

 private void readBodyBytes() {
    if (this.bodyContent == null) {
      try {
        byte[] bodyBytes = readInputBody(request.getInputStream());
        this.bodyContent = new String(AesEncrypt.decrypt(bodyBytes), charset);
      } catch (IOException e) {
        throw new RuntimeException(e);
      }
    }
  }  

 private byte[] readInputBody(InputStream inputStream) throws IOException {
    ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
    byte[] buffer = new byte[1024];
    int len;
    while ((len = inputStream.read(buffer)) > -1) {
      byteArrayOutputStream.write(buffer, 0, len);
    }
    byteArrayOutputStream.flush();
    return byteArrayOutputStream.toByteArray();
  }  
  
  @Override
  public String getQueryString() {
    return queryString;
  }

  @Override
  public String getParameter(String name) {
    String[] values = getParameterValues(name);
    return values == null || values.length == 0 ? null : values[0];
  }
  @Override
  public int getContentLength() {
    return bodyContent.getBytes(charset).length;
  }

  @Override
  public long getContentLengthLong() {
    return bodyContent.getBytes(charset).length;
  }

     @Override
  public Map<String, String[]> getParameterMap() {
    if (paramsMap == null) {
      paramsMap = new HashMap<>();
      Enumeration<String> nameEnum = this.parameters.getParameterNames();
      while (nameEnum.hasMoreElements()) {
        String name = nameEnum.nextElement();
        paramsMap.put(name, getParameterValues(name));
      }
    }
    return paramsMap;
  }

  @Override
  public Enumeration<String> getParameterNames() {
    return this.parameters.getParameterNames();
  }

  @Override
  public String[] getParameterValues(String name) {
    return parameters.getParameterValues(name);
  }
}

/**
* (2) 响应拦截 加密
**/

@ControllerAdvice
public class AesResponseAdvice implements ResponseBodyAdvice<Object> {
        
    private static final String AES_KEY= "AES_KEY";
  


      @Override
    public Object beforeBodyWrite(Object body, MethodParameter methodParameter,
                                  MediaType mediaType,
                                  Class<? extends HttpMessageConverter<?>> converterClass,
                                  ServerHttpRequest serverHttpRequest,
                                  ServerHttpResponse serverHttpResponse) {
        ServletServerHttpRequest request = (ServletServerHttpRequest) serverHttpRequest;
        if (body != null) {
            ServletServerHttpResponse response = (ServletServerHttpResponse) serverHttpResponse;
            try {
                byte[] contentBytes = null;
                    contentBytes = String.valueOf(body).getBytes(Charset.forName("UTF-8"));
                 Object aesKey = request.getServletRequest().getSession().getAttribute(AES_KEY);
               body = AesEncrypt.encrypt(contentBytes,String.value(aesKey));
                
            } catch (IOException e) {
                LOGGER.error("加密数据失败", e);
            }
        }
        return body;
    }

}

方案一请求响应参数自定义加密字段(比如id)

1.优缺点

a.优点：效率高，只加密某些重要字段

b.缺点：实现复杂

2.开发步骤

a.自定义注解 @Encrypt，放属性上或者参数上

@JacksonAnnotation
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.FIELD, ElementType.PARAMETER})
public @interface Encrypt {
    String value() default "";
    String fieldName() default "";
    String[] ignoreValue() default {};
}

b.springmvc中增加请求参数解析器，响应参数解析器

public class EncryptRequestParamMethodArgumentResolver extends RequestParamMethodArgumentResolver {
    IEncryptionService encryptionService;

    @Override
    @Nullable
    protected Object resolveName(String name, MethodParameter parameter, NativeWebRequest request) throws Exception {
        Object result = super.resolveName(name, parameter, request);
        if (EncryptContext.isEncrypt() && result != null && parameter.hasParameterAnnotation(Encrypt.class)) {
            Encrypt encrypt = parameter.getParameterAnnotation(Encrypt.class);
            if (result instanceof String && !EncryptUtils.ignoreValue(encrypt, (String) result)) {
                if (isArray(parameter)) {
                    result = ((String) result).split(",");
                } else {
                    result = encryptionService.decrypt(((String) result), encrypt.value());
                    return result;
                }
            }
            if (result instanceof String[]) {
                String[] oldResult = (String[]) result;
                String[] newResult = new String[oldResult.length];
                for (int i = 0; i < oldResult.length; i++) {
                    if (EncryptUtils.ignoreValue(encrypt, oldResult[i])) {
                        newResult[i] = oldResult[i];
                    } else {
                        newResult[i] = encryptionService.decrypt(oldResult[i], encrypt.value());
                    }
                }
                return newResult;
            }
        }
        return result;
    }

public class EncryptRequestResponseBodyMethodProcessor extends RequestResponseBodyMethodProcessor {

    @Override
    public Object resolveArgument(MethodParameter parameter, @Nullable ModelAndViewContainer mavContainer,
                                  NativeWebRequest webRequest, @Nullable WebDataBinderFactory binderFactory) throws Exception {
        if (!EncryptContext.isEncrypt()) {
            return super.resolveArgument(parameter, mavContainer, webRequest, binderFactory);
        }
        Encrypt encrypt = parameter.getParameterAnnotation(Encrypt.class);
        if (encrypt == null) {
            return super.resolveArgument(parameter, mavContainer, webRequest, binderFactory);
        }
        // 如果是集合类，且范型类型是基础类型的包装类型
        if (Collection.class.isAssignableFrom(parameter.getParameterType())) {
            return resolveCollectionArgument(parameter, mavContainer, webRequest, binderFactory, encrypt);
        }
        // 如果是集合类，且范型类型是基础类型的包装类型
        if (parameter.getParameterType().isArray()) {
            return resolveArrayArgument(parameter, mavContainer, webRequest, binderFactory, encrypt);
        }
        // 如果是 Map 类，且泛型类型是基础类型顶的包装类型
        if (Map.class.isAssignableFrom(parameter.getParameterType())) {
            return resolveMapArgument(parameter, mavContainer, webRequest, binderFactory, encrypt);
        }
        return super.resolveArgument(parameter, mavContainer, webRequest, binderFactory);
    }
    
}

c.将请求，响应参数解析器，加入到springmvc解析器列表中HandlerMethodArgumentResolver

public class WebBeanPostProcessor implements BeanPostProcessor, PriorityOrdered {
    @Nullable
    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
        if (bean instanceof RequestMappingHandlerAdapter) {
            RequestMappingHandlerAdapter adapter = (RequestMappingHandlerAdapter) bean;
            List<HandlerMethodArgumentResolver> currentResolvers = adapter.getArgumentResolvers();
            if (currentResolvers == null) {
                throw new IllegalStateException(
                        String.format("No HandlerMethodArgumentResolvers found in RequestMappingHandlerAdapter %s!", beanName));
            }
            //IEncryptionService encryptionService = new EncryptionService();
            //替换PathVariableMethodArgumentResolver 和 RequestParamMethodArgumentResolver
            PathVariableMethodArgumentResolver pathVariableMethodArgumentResolver = new EncryptPathVariableMethodArgumentResolver(encryptionService);
            RequestParamMethodArgumentResolver requestParamMethodArgumentResolverFalse = new EncryptRequestParamMethodArgumentResolver(encryptionService, beanFactory, false);
            RequestParamMethodArgumentResolver requestParamMethodArgumentResolverTrue = new EncryptRequestParamMethodArgumentResolver(encryptionService, beanFactory, true);
            EncryptRequestResponseBodyMethodProcessor encryptRequestResponseBodyMethodProcessor;
            try {
                encryptRequestResponseBodyMethodProcessor = new EncryptRequestResponseBodyMethodProcessor(adapter.getMessageConverters(),
                        (List<Object>) FieldUtils.readDeclaredField(adapter, "requestResponseBodyAdvice", true));
            } catch (IllegalAccessException e) {
                throw new CommonException(e);
            }
            encryptRequestResponseBodyMethodProcessor.setEncryptionService(encryptionService);
            List<HandlerMethodArgumentResolver> resolvers = new ArrayList<>(adapter.getArgumentResolvers().size());
            //spring 默认注册了2个requestParamMethodArgumentResolver
            boolean isFirst = true;
            for (HandlerMethodArgumentResolver resolver : adapter.getArgumentResolvers()) {
                if (resolver instanceof PathVariableMethodArgumentResolver) {
                    resolvers.add(pathVariableMethodArgumentResolver);
                    continue;
                }
                if (resolver instanceof RequestParamMethodArgumentResolver) {
                    if (isFirst) {
                        resolvers.add(requestParamMethodArgumentResolverFalse);
                        isFirst = false;
                        continue;
                    }
                    resolvers.add(requestParamMethodArgumentResolverTrue);
                    continue;
                }
                if (resolver instanceof RequestResponseBodyMethodProcessor) {
                    resolvers.add(encryptRequestResponseBodyMethodProcessor);
                    continue;
                }
                resolvers.add(resolver);
            }
            adapter.setArgumentResolvers(resolvers);
            
}