Sign verification of api interface data security solution in thinkphp

Aes encryption and decryption class

Click me to view

Package verification class ApiAuth.php

<?php

namespace app\common\lib;

use app\common\lib\Aes;


class ApiAuth
{
    
    

    /*
     * 生成签名
     */
    public static function setSign($data = [])
    {
    
    
        //1 把数组按照字段你排序
        ksort($data);
        //2 将数组更改为拼接字符串的格式
        $sign_str = http_build_query($data);
        //3 通过aes加密
        return (new Aes())->encrypt($sign_str);
    }

    //校验签名sign
    public static function checkSign($data)
    {
    
    
        //解密
        $str = (new Aes())->decrypt($data['sign']);
        if (!$str) {
    
    
            return false;
        }
        //将字符串你转成数组格式
        parse_str($str, $arr);
        //比较
        if (!is_array($arr) || $arr['name'] != 'qipa250') {
    
    
            return false;
        }
        return true;
    }
}

Call the verification method in the Common class

In the controller of the api module, create a common common class, and other classes inherit this class

<?php

namespace app\api\controller;

use app\common\lib\ApiAuth;
use think\Controller;

use app\common\lib\exception\ApiException;

use app\common\lib\Aes;

/*
 * api接口模块的公共控制器
 */

class Common extends Controller
{
    
    

    public function _initialize()
    {
    
    
          $this->checkRequestAuth();    
    }

    //验证方法
    /*
     * 检查app每一次提交的数据是否合法
     */
    public function checkRequestAuth()
    {
    
    

        //验证header头的信息
        $header = request()->header();
        //halt($header);


        //sign 客户端工程师加密，服务端工程师解密

        //基础数据校验
        //如果sign不存在，报错
        if (empty($header['sign'])) {
    
    
            throw new ApiException('签名不存在！');
        }

        if (empty($header['apptype'])) {
    
    
            throw new ApiException('客户端不存在！');
        }

        //验证请求的app客户端是否合法
        if (!in_array($header['apptype'], config('app.apptypes'))) {
    
    
            throw new ApiException('客户端不合法！', 400);
        }

        //校验sign
        $header_result = ApiAuth::checkSign($header);
        dump($header_result);
        die();
    }
}

Throw the exception class ApiException

<?php

namespace app\common\lib\exception;

//引用异常类
use think\Exception;


//继承异常类
class ApiException extends Exception
{
    
    
    //自定义http状态码
    public $message = '';
    public $httpCode = 400;
    public $code = 0;

    /*
     * 渲染抛出异常的状态码和信息
     */
    public function __construct($message = "", $httpCode = 0, $code = 0)
    {
    
    
        $this->message = $message;
        $this->httpCode = $httpCode?:400;
        $this->code = $code;
    }
}

app.php configuration file

<?php

return [
    'admin_password_pre' => '_qipa250',//后台管理员密码加密后缀
    'aeskey' => 'QiPa250',//aes 密钥，服务端和客户端保持一致
    'aesiv' => '12345678901234567890123456789012',//aes iv，服务端和客户端保持一致
    'apptypes' => ['ios', 'android', 'wechat'],
];

Postman request, return true to indicate successful signature verification

Return false, indicating that the signature verification failed