Qiao talk about the security of data interfaces

Data Interface safety course

As business needs before, involves some aspects of the work of reptiles, found part of a niche product security problems in the data interface, the interface can be invoked even modify any part of the data (without any safety measures ah). Not to be 'Heaven'. So I work in conjunction with their understanding of the background on port security record.

Especially now that most of the projects are separated from the front and rear end, back-end interface security is a top priority. After all, data is money

Token validation

Token validation that I used to do in the beginning of the project the way mobile interface.

The so-called Token validation is that when the user ID and password to log in operation, the server returned to the client after login Token and Token login and user association in the cache server ( Redis) and its set time limit (usually 30 minutes ), followed by customer service side every access need Token to the server side, the background to verify Token, Token that is correct by verifying

Key Code

//验证token
String token = request.getHeader("Token");
if(!jedisPoolService.exists(token)) 
  throw new TokenException("token is invalid");
复制代码

Token validation + ip illegal access

But above current Token can only judge whether there is, but if there is a Token doing something, you can not control. (Code calls through this interface for a long time)

Therefore, Token validation based on the judgment together with the illegal ip:

IP Blacklist: If the current ip access over a period of time (1 minute) than the number of visits we defined the problem is with the corresponding ip access, then ban and the current ip ip access Add to blacklist

Before accessing the interface, to determine whether ip ip blacklist, if, on the prohibition of the ip access

Key Code

//判断ip
String ip = GlobalUtil.getIpAddr(request);  //获取当前IP

if(jedisPoolService.sismember(IP_BLOCK, ip)) {
    throw new NoParamException("黑名单禁止访问");
}

//判断当前ip是否超过访问次数
String key = IP_KEY.replace("{key}", ip);
int count = StringUtil.toInteger(jedisPoolService.get(key) != null ? jedisPoolService.get(key) : 0);
if(count > MAX_COUNT) {
    jedisPoolService.putSet(IP_BLOCK, ip);
    throw new NoParamException("超过访问次数");
}

jedisPoolService.incrAtTime(key, MAX_COUNT);
复制代码

Token + timestamp + sign signature + ip illegal access

After exposure to a lot of third-party payment, it will try its own interface upgrade project

On the basis of the Token verification, together with a time stamp and sign the signature timestamp. Conventions timestamp time stamp and the current time exceeds the predetermined range (for example: 1 minute) that is currently accessing the interface is determined incorrect.

About sign signature operation

The parameters of the request sorted arranged in ascending ASCII
The sorting is done splicing parameters (sign parameter) in the form key1 = value1 & key2 = value2 of
The string of splicing performed to obtain the MD5 signature sign (front and rear ends may be appropriate conventions of salt)

Key Code

//时间戳
Object o = objectMap.get("timestamp");
if(o == null)
  throw new NoParamException("参数timestamp为空");

Long timestamp = StringUtil.toLong(o);
if (LocalDateUtils.nowTime().getTime() - timestamp >= 1 * 60 * 1000)
  throw new NoParamException("timestamp已过期");

//sign
private String getSign2Map(Map<String, Object> map) {
  StringBuffer sb = new StringBuffer();
  ArrayList<String> list = new ArrayList<String>(map.keySet());
  Collections.sort(list);

  for (String key : list) {
      Object value = map.get(key);
      if (!key.equalsIgnoreCase("sign"))
          sb.append(key).append("=").append(map.get(key)).append("&");
  }
  sb.deleteCharAt(sb.length() - 1);
  return DigestUtil.getInstance().md5(sb.toString());
}
复制代码

Big move Token + timestamp + sign signature + + Https illegal ip access

HTTPS: HTTP-based protocol to provide encrypted data through SSL or TLS, verify each other's identity and data integrity protection

Https slightly higher cost, SSL certificates need to purchase the application, the more powerful the certificate fee

Click here for a free SSL certificate request

Above to a large extent to ensure port security, but it is not necessarily safe (silly still a lot of people do). -_- ~~

Notice

Theory is not equal to actual combat, the actual development there are still many details of things that need improvement. The next section to achieve the above-described specific manner