PHP development is inseparable from API signature verification, how do you design?

The development process, we often deal with the interface, the interface sometimes is the transfer of the site to others, sometimes your site is to provide an interface for others, but in the process it can not do without the transfer of the signature verification.

When we design signature verification, please pay attention to the following points:

• Variability: Each signature must be different.

• Timeliness: each request aging, expired like.

• Uniqueness: Each signature is unique.

• Integrity: the ability to validate incoming data against tampering.

   

One way to introduce here, is currently the Internet company common way in which Taobao Alipay payment interface, Taobao Open Platform Interface, Tencent open a way of application platforms.

 

A signature generation method parameter sign

Step 1: All the parameters (note that all the parameters) to remove sign itself is empty and the value of the parameter, the parameter names sorted in ascending alphabetical order.

Step 2: then the parameters sorted by a value of the parameter a parameter 2 value 2 ... parameter values ​​of n n (where parameters and values ​​that must be the original values ​​of the transmission parameters, can not be treated, if not the & quot; turn to "and then splicing) is spliced ​​into a string.

Step 3: The front of the character allocated to the access side of the splice verification key key obtained in step 2.

Step 2: a step in front of the string obtained by adding the authentication key key (here, key KEY that is an interface that provides an interface to the assigned access square), then calculate the value md5 obtain 32-bit string, and then turn uppercase.

Step 4: Step 3 md5 calculated value of the string (32), then turn uppercase character string obtained as the value of the sign.

 

For example:

Assumed that the transmission data is /interface.php?sign=sign_value&p2=v2& p1 = v1 & method = value cancel & p3 = & pn = vn (preferably reality transmitted by way of post), wherein the parameters corresponding to the sign is sign_value signature.

The first step, string concatenation, first removing the sign parameter itself, and then removing the value is null parameter p3, the remaining p2 = v2 & p1 = v1 & method = cancel & amp; pn = vn, and then press the parameter names of characters in ascending order, method = cancel & p1 = v1 & p2 = v2 & pn = vn.

The second step, then do the stitching parameter names and values, and finally get methodcancelp1v1p2v2pnvn
third step, before splicing the resulting string above plus authentication key key, we assume abc, get new string abcmethodcancelp1v1p2v2pnvn

A fourth step, then this string md5 calculated, assuming abcdef is obtained, and then to upper, obtained ABCDEF This value is a sign signature value.

Note, Please ensure that the interface string code before accessing party MD5 calculation, using as a unified coding or GBK utf-8 encoded, encoding is inconsistent if the calculated signature verification will fail.

Second, the signature verification method:

The method according to the rules described earlier sign signature parameters generated, the signature value calculated parameters, and parameter values ​​corresponding to the parameters in the notification sign over the comparison, if it is consistent, then the check is passed, if not, the parameters are described modified.

 

Third, look at the code directly below

. 1 ? < PHP
 2  // set a public key (key) and a private key (Secret), for distinguishing a user public key, private key encryption of data, is not disclosed 
. 3  $ Key = "c4ca4238a0b923820dcc509a6f75849b" ;
 . 4  $ Secret = "28c8edde3d61a0411511d3b1866f0636" ;
 . 5  
. 6  // data packet to be transmitted 
. 7  $ data = Array (
 . 8      'username' => '[email protected]',
 . 9      'Sex' => '. 1',
 10      'Age' => '16',
 . 11      'addr' => 'Guangzhou',
 12 is      'Key' => $ Key ,
13     'timestamp' => time(),
14  );
 15  
16  // Get Sign 
. 17  function (getSign $ Secret , $ Data )
 18 is  {
 . 19      // value of the array of sorted Key 
20 is      ksort ( $ Data );
 21 is      // generated url form 
22 is      $ the params = http_build_query ( $ Data );
 23 is      // generated Sign 
24      $ Sign = MD5 ( $ the params . $ Secret );
 25      return  $ Sign ;
 26 is }
 27  
28  // data transmission plus sign 
29  $ Data [ 'sign'] = getSign ( $ Secret , $ Data );
 30  
31 is  / * *
 32  * background verification is legitimate sign
 33 is  * @param [type] $ Secret [Description]
 34 is  * @param [type] $ Data [Description]
 35  * @return [type] [Description]
 36   * / 
37 [  function verifySign ( $ Secret , $ Data )
 38 is  {
 39      // whether a signature verification parameter 
40      IF (! isset (Data $ [ 'Sign']) ||! $ Data [ 'Sign' ]) {
 41 is          echo 'signature transmitted data does not exist' ;
 42 is          Die ();
 43 is      }
 44 is      IF ! ( isset ( $ Data [ 'timestamp' !]) || $ data [ 'timestamp' ]) {
 45          echo 'parameter transmitted data is illegal' ;
 46 is          Die ();
 47      }
 48      // verification request 10 minutes failure 
49      IF ( Time () - $ data [ 'timestamp']> 600 ) {
 50          echo'Authentication failure, please resend request' ;
 51 is          Die ();
 52 is      }
 53 is      $ Sign = $ Data [ 'Sign' ];
 54 is      the unset ( $ Data [ 'Sign' ]);
 55      ksort ( $ Data );
 56 is      $ the params = http_build_query ( $ Data );
 57 is      // $ Secret key query is obtained by api database 
58      $ sign2 = MD5 ( $ the params . $ Secret );
 59      IF ( $ Sign ==$ sign2 ) {
 60          Die ( 'verified' );
 61 is      } the else {
 62 is          Die ( 'request is illegal' );
 63 is      }
 64  }
 65  
66  $ RES = verifySign ( $ Secret , $ Data );
 67  echo "<pre > " ;
 68  print_r ( $ RES );
 69  echo " <pre> " ;
 70  Exit ;
 71 >?

 

Link: https: //mp.weixin.qq.com/s/5_3Zol1O0sxNjsfHKPdTXQ