API网关怎么设计？你知道吗？

1. 什么是API网关？

API网关是一个轻量的java http 接口组件，可无缝将普通的Service方法转换成http接口。并从以下几个方卖弄来达到提高开发效率与接口质量的目的。

(1) 去掉mvc控制器，将http请求无缝接入JAVA服务接口

(2) 统一出入参格式

(3) 统一异常规范

(4) 自动检测服务接口规范

2.API网关与普通Http接口实现流程对比

3.网关实现流程与技术

名称	类型	描述
method	string	方法名称
paramter	json	业务参数
timestamp	long	请求时间戳

实现技术

• java servlet
• spring ioc
• JSON 转换工具的使用

4.接口安全的业务需求

(1) 接口安全级别分组

• 白名单组
• 黑名单组
• 黑白名单组

(2) 基于Token安全机制认证需求

• 登录鉴权
• 防止业务参数串改
• 保护有用户敏感信息
• 防签名伪造

(3) Token认证整体架构

**整体架构分为Token生成与认证两部分 **

• Token生成指在登录成功之后生成Token和秘钥，并其与用户信息、客户端信息一起存储到Token表，同时返回Token与Secret至客户端。
• Token认证指客户端请求黑名单接口时，认证中心基于Token生成签名

Token表结构说明

名称	类别	说明	约束
id	number	id主键	主键，自增长
memberId	number	会员ID
accessToken	varchar(50)	Token	索引
secret	varchar(50)	密钥
createdTime	datetime	创建时间
expiresTime	datetime	有效期至
clientIp	varchar(50)	客户端IP
clientType	varchar(50)	客户端类别
eCode	varchar(50)	设备标识
uCode	varchar(50)	设备用户标识

签名规则

• 已指定顺序拼接字符串 secret+method+param+token+timestamp+secret
• 使用MD5进行加密，在转化成大写

签名的目的

1. 防串改
2. 防伪造
3. 防重复使用签名

服务端签名验证的具体流程

(4) 基于API网关实现安全机制

签名认证与API网关的整体认证流程

两个流程

token生成:登录成功后，生成token与secret保存到数据库

Token认证相关解决方案:

• 接口如果表示黑白名单
• 签名具体验证流程
• 用户ID等信息如果传递给业务实现接口

5. 代码实现

core包下类

public class ApiStore {
    
    
    private ApplicationContext applicationContext;
    // API 接口住的地方 
    private HashMap<String, ApiRunnable> apiMap = new HashMap<String, ApiRunnable>();
    
    
// spring ioc 
    public ApiStore(ApplicationContext applicationContext) {
    
    
        Assert.notNull(applicationContext);
        this.applicationContext = applicationContext;
    }
    /**
     * 
     */
    public void loadApiFromSpringBeans() {
    
    
    	// ioc 所有BEan
    	// spring ioc 扫描
        String[] names = applicationContext.getBeanDefinitionNames();
        Class<?> type;
        //反谢
        for (String name : names) {
    
    
            type = applicationContext.getType(name);
            for (Method m : type.getDeclaredMethods()) {
    
    
            	// 通过反谢拿到APIMapping注解
                APIMapping apiMapping = m.getAnnotation(APIMapping.class);
                if (apiMapping != null) {
    
    
                    addApiItem(apiMapping, name, m);
                }
            }
        }
    }

    public ApiRunnable findApiRunnable(String apiName) {
    
    
        return apiMap.get(apiName);
    }

    /**
     * 
     * 添加api <br/>
     * 
     * @param apiMapping
     *            api配置
     * @param beanName
     *            beanq在spring context中的名称
     * @param method
     */
    private void addApiItem(APIMapping apiMapping, String beanName, Method method) {
    
    
    	ApiRunnable apiRun = new ApiRunnable();
        apiRun.apiName = apiMapping.value();
        apiRun.targetMethod = method;
        apiRun.targetName = beanName;
        apiRun.apiMapping=apiMapping;
        apiMap.put(apiMapping.value(), apiRun);
    }

    public ApiRunnable findApiRunnable(String apiName, String version) {
    
    
        return (ApiRunnable) apiMap.get(apiName + "_" + version);
    }

    public List<ApiRunnable> findApiRunnables(String apiName) {
    
    
        if (apiName == null) {
    
    
            throw new IllegalArgumentException("api name must not null!");
        }
        List<ApiRunnable> list = new ArrayList<ApiRunnable>(20);
        for (ApiRunnable api : apiMap.values()) {
    
    
            if (api.apiName.equals(apiName)) {
    
    
                list.add(api);
            }
        }
        return list;
    }

    public List<ApiRunnable> getAll() {
    
    
        List<ApiRunnable> list = new ArrayList<ApiRunnable>(20);
        list.addAll(apiMap.values());
        Collections.sort(list, new Comparator<ApiRunnable>() {
    
    
            public int compare(ApiRunnable o1, ApiRunnable o2) {
    
    
                return o1.getApiName().compareTo(o2.getApiName());
            }
        });
        return list;
    }

    public boolean containsApi(String apiName, String version) {
    
    
        return apiMap.containsKey(apiName + "_" + version);
    }

    public ApplicationContext getApplicationContext() {
    
    
        return applicationContext;
    }

    
    // 用于执行对应的API方法，
    public class ApiRunnable {
    
    
        String apiName;  //bit.api.user.getUser

        String targetName; //ioc bean 名称

        Object target; // UserServiceImpl 实例
        Method targetMethod; // 目标方法 getUser
        APIMapping apiMapping;

        public Object run(Object... args) throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {
    
    
			if (target == null) {
    
     // spring ioc 容器里面去服务Bean 比如GoodsServiceImpl
				target = applicationContext.getBean(targetName);
            }
            return targetMethod.invoke(target, args);
        }

        public Class<?>[] getParamTypes() {
    
    
            return targetMethod.getParameterTypes();
        }

        public String getApiName() {
    
    
            return apiName;
        }

        public String getTargetName() {
    
    
            return targetName;
        }

        public Object getTarget() {
    
    
            return target;
        }

        public Method getTargetMethod() {
    
    
            return targetMethod;
        }

        public APIMapping getApiMapping() {
    
    
            return apiMapping;
        }
    }

}

public class ApiRequest {
    
    

    private String memberId;
    private String accessToken;
    private String sign;
    private String uCode;
    private String eCode;
    private String timestamp;
    private String clientIp;
    private boolean isLogin;
    private String params;

    private String methodName;


    public String getMemberId() {
    
    
        return memberId;
    }

    public void setMemberId(String memberId) {
    
    
        this.memberId = memberId;
    }

    public String getAccessToken() {
    
    
        return accessToken;
    }

    public void setAccessToken(String accessToken) {
    
    
        this.accessToken = accessToken;
    }

    public String getSign() {
    
    
        return sign;
    }

    public void setSign(String sign) {
    
    
        this.sign = sign;
    }

    public String getuCode() {
    
    
        return uCode;
    }

    public void setuCode(String uCode) {
    
    
        this.uCode = uCode;
    }

    public String geteCode() {
    
    
        return eCode;
    }

    public void seteCode(String eCode) {
    
    
        this.eCode = eCode;
    }

    public String getTimestamp() {
    
    
        return timestamp;
    }

    public void setTimestamp(String timestamp) {
    
    
        this.timestamp = timestamp;
    }

    public String getClientIp() {
    
    
        return clientIp;
    }

    public void setClientIp(String clientIp) {
    
    
        this.clientIp = clientIp;
    }

    public boolean isLogin() {
    
    
        return isLogin;
    }

    public void setLogin(boolean login) {
    
    
        isLogin = login;
    }

    public String getParams() {
    
    
        return params;
    }

    public void setParams(String params) {
    
    
        this.params = params;
    }

    public String getMethodName() {
    
    
        return methodName;
    }

    public void setMethodName(String methodName) {
    
    
        this.methodName = methodName;
    }
}

public class Token  implements java.io.Serializable{
    
    

    private long id;
    private String memberId;
    private String accessToken;
    private String secret;
    private Date createdTime;
    private Date expiresTime;
    private String clientIp;
    private String clientType;
    private String eCode;
    private String uCode;


    public long getId() {
    
    
        return id;
    }

    public void setId(long id) {
    
    
        this.id = id;
    }

    public String getMemberId() {
    
    
        return memberId;
    }

    public void setMemberId(String memberId) {
    
    
        this.memberId = memberId;
    }

    public String getAccessToken() {
    
    
        return accessToken;
    }

    public void setAccessToken(String accessToken) {
    
    
        this.accessToken = accessToken;
    }

    public String getSecret() {
    
    
        return secret;
    }

    public void setSecret(String secret) {
    
    
        this.secret = secret;
    }

    public Date getCreatedTime() {
    
    
        return createdTime;
    }

    public void setCreatedTime(Date createdTime) {
    
    
        this.createdTime = createdTime;
    }

    public Date getExpiresTime() {
    
    
        return expiresTime;
    }

    public void setExpiresTime(Date expiresTime) {
    
    
        this.expiresTime = expiresTime;
    }

    public String getClientIp() {
    
    
        return clientIp;
    }

    public void setClientIp(String clientIp) {
    
    
        this.clientIp = clientIp;
    }

    public String getClientType() {
    
    
        return clientType;
    }

    public void setClientType(String clientType) {
    
    
        this.clientType = clientType;
    }

    public String geteCode() {
    
    
        return eCode;
    }

    public void seteCode(String eCode) {
    
    
        this.eCode = eCode;
    }

    public String getuCode() {
    
    
        return uCode;
    }

    public void setuCode(String uCode) {
    
    
        this.uCode = uCode;
    }
}

public interface TokenService {
    
    

    public Token createToken();

    public Token getToken(String token);
}

public class ApiGatewayHand implements InitializingBean, ApplicationContextAware {
    
    
    private static final Logger logger = LoggerFactory.getLogger(ApiGatewayHand.class);

    private static final String METHOD = "method";
    private static final String PARAMS = "params";

    ApiStore apiSorte;
    final ParameterNameDiscoverer parameterUtil;
    private TokenService tokenService;

    public ApiGatewayHand() {
    
    
        parameterUtil = new LocalVariableTableParameterNameDiscoverer();
    }

    @Override
    public void setApplicationContext(ApplicationContext context) throws BeansException {
    
    
        apiSorte = new ApiStore(context);
    }

    @Override
    public void afterPropertiesSet() throws Exception {
    
    
        apiSorte.loadApiFromSpringBeans();
    }

    public void handle(HttpServletRequest request, HttpServletResponse response) {
    
    
        // 系统参数验证
        String params = request.getParameter(PARAMS);
        String method = request.getParameter(METHOD);
        Object result;
        ApiRunnable apiRun = null;
        ApiRequest apiRequest = null;
        try {
    
    
            apiRun = sysParamsValdate(request);
            // 构建apiRequest
            apiRequest = buildApiRequest(request);
            // 签名验证
            if (apiRequest.getAccessToken() != null)
                signCheck(apiRequest);

            if (apiRun.getApiMapping().useLogin()) {
    
    
                if (apiRequest.isLogin()) {
    
    
                     throw new ApiException("009","调用失败：用户未登陆");
                }
            }


            logger.info("请求接口={" + method + "} 参数=" + params + "");
            Object[] args = buildParams(apiRun, params, request, response,apiRequest);
            result = apiRun.run(args);
        } catch (ApiException e) {
    
    
            response.setStatus(500);// 封装异常并返回
            logger.error("调用接口={" + method + "}异常  参数=" + params + "", e);
            result = handleError(e);
        } catch (InvocationTargetException e) {
    
    
            response.setStatus(500);// 封装业务异常并返回
            logger.error("调用接口={" + method + "}异常  参数=" + params + "", e.getTargetException());
            result = handleError(e.getTargetException());
        } catch (Exception e) {
    
    
            response.setStatus(500);// 封装业务异常并返回
            logger.error("其他异常", e);
            result = handleError(e);
        }

        // 统一返回结果
        returnResult(result, response);
    }

    private ApiRequest buildApiRequest(HttpServletRequest request) {
    
    
        ApiRequest apiRequest = new ApiRequest();
        apiRequest.setAccessToken(request.getParameter("token"));
        apiRequest.setSign(request.getParameter("sign"));
        apiRequest.setTimestamp(request.getParameter("timestamp"));
        apiRequest.seteCode(request.getParameter("eCode"));
        apiRequest.setuCode(request.getParameter("uCode"));
        apiRequest.setParams(request.getParameter("params"));
        return apiRequest;
    }

    private ApiRequest signCheck(ApiRequest request) throws ApiException {
    
    
        Token token = tokenService.getToken(request.getAccessToken());
        if (token == null) {
    
    
            throw new ApiException("验证失败：指定'Token'不存在");
        }
        if (token.getExpiresTime().before(new Date())) {
    
    
            throw new ApiException("验证失败：指定'Token'已失效");
        }
        // 生成签名
        String methodName = request.getMethodName();
        String accessToken = token.getAccessToken();
        String secret = token.getSecret();
        String params = request.getParams();
        String timestamp = request.getTimestamp();
        String sign = Md5Util.MD5(secret + methodName + params + token + timestamp + secret);

        if (!sign.toUpperCase().equals(request.getSign())) {
    
    
            throw new ApiException("验证失败：签名非法");
        }

        // 时间验证
        if (Math.abs(Long.valueOf(timestamp) - System.currentTimeMillis()) > 10 * 60 * 1000) {
    
    
            throw new ApiException("验证失败：签名失效");
        }

        request.setLogin(true);
        request.setMemberId(token.getMemberId());
        return request;
    }


    private Object handleError(Throwable throwable) {
    
    
        String code = "";
        String message = "";

        if (throwable instanceof ApiException) {
    
    
            code = "0001";
            message = throwable.getMessage();
        } // 扩展异常规范
        else {
    
    
            code = "0002";
            message = throwable.getMessage();
        }

        Map<String, Object> result = new HashMap<>();
        result.put("error", code);
        result.put("msg", message);
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        PrintStream stream = new PrintStream(out);
        throwable.printStackTrace(stream);
//        result.put("stack", out.toString());
        return result;
    }

    private ApiRunnable sysParamsValdate(HttpServletRequest request) throws ApiException {
    
    
        String apiName = request.getParameter(METHOD);
        String json = request.getParameter(PARAMS);

        ApiRunnable api;
        if (apiName == null || apiName.trim().equals("")) {
    
    
            throw new ApiException("调用失败：参数&#39;method&#39;为空");
        } else if (json == null) {
    
    
            throw new ApiException("调用失败：参数&#39;params&#39;为空");
        } else if ((api = apiSorte.findApiRunnable(apiName)) == null) {
    
    
            throw new ApiException("调用失败：指定API不存在，API:" + apiName);
        }
        // 多一个签名参数
        // 
        return api;
    }

    /***
     * 验证业务参数，和构建业务参数对象
     * @param run
     * @param paramJson
     * @param request
     * @param response
     * @param apiRequest
     * @return
     * @throws ApiException
     */
    private Object[] buildParams(ApiRunnable run, String paramJson, HttpServletRequest request, HttpServletResponse response, ApiRequest apiRequest)
            throws ApiException {
    
    
        Map<String, Object> map = null;
        try {
    
    
            map = UtilJson.toMap(paramJson);
        } catch (IllegalArgumentException e) {
    
    
            throw new ApiException("调用失败：json字符串格式异常，请检查params参数 ");
        }
        if (map == null) {
    
    
            map = new HashMap<>();
        }

        Method method = run.getTargetMethod();// javassist
        List<String> paramNames = Arrays.asList(parameterUtil.getParameterNames(method));
        // goods ,id
        Class<?>[] paramTypes = method.getParameterTypes(); //反射

        for (Map.Entry<String, Object> m : map.entrySet()) {
    
    
            if (!paramNames.contains(m.getKey())) {
    
    
                throw new ApiException("调用失败：接口不存在‘" + m.getKey() + "’参数");
            }
        }
        Object[] args = new Object[paramTypes.length];
        for (int i = 0; i < paramTypes.length; i++) {
    
    
            if (paramTypes[i].isAssignableFrom(HttpServletRequest.class)) {
    
    
                args[i] = request;
            } else if (paramTypes[i].isAssignableFrom(ApiRequest.class)){
    
    
                args[i] = apiRequest;
            }else if (map.containsKey(paramNames.get(i))) {
    
    
                try {
    
    
                    args[i] = convertJsonToBean(map.get(paramNames.get(i)), paramTypes[i]);
                } catch (Exception e) {
    
    
                    throw new ApiException("调用失败：指定参数格式错误或值错误‘" + paramNames.get(i) + "’"
                            + e.getMessage());
                }
            } else {
    
    
                args[i] = null;
            }
        }
        return args;
    }

    // 将MAP转换成具体的目标方方法参数对象
    private <T> Object convertJsonToBean(Object val, Class<T> targetClass) throws Exception {
    
    
        Object result = null;
        if (val == null) {
    
    
            return null;
        } else if (Integer.class.equals(targetClass)) {
    
    
            result = Integer.parseInt(val.toString());
        } else if (Long.class.equals(targetClass)) {
    
    
            result = Long.parseLong(val.toString());
        } else if (Date.class.equals(targetClass)) {
    
    
            if (val.toString().matches("[0-9]+")) {
    
    
                result = new Date(Long.parseLong(val.toString()));
            } else {
    
    
                throw new IllegalArgumentException("日期必须是长整型的时间戳");
            }
        } else if (String.class.equals(targetClass)) {
    
    
            if (val instanceof String) {
    
    
                result = val;
            } else {
    
    
                throw new IllegalArgumentException("转换目标类型为字符串");
            }
        } else {
    
    
            result = UtilJson.convertValue(val, targetClass);
        }
        return result;
    }

    private void returnResult(Object result, HttpServletResponse response) {
    
    
        try {
    
    
            UtilJson.JSON_MAPPER.configure(
                    SerializationFeature.WRITE_NULL_MAP_VALUES, true);
            String json = UtilJson.writeValueAsString(result);
            response.setCharacterEncoding("UTF-8");
            response.setContentType("text/html/json;charset=utf-8");
            response.setHeader("Cache-Control", "no-cache");
            response.setHeader("Pragma", "no-cache");
            response.setDateHeader("Expires", 0);
            if (json != null)
                response.getWriter().write(json);
        } catch (IOException e) {
    
    
            logger.error("服务中心响应异常", e);
            throw new RuntimeException(e);
        }
    }

    public static void main(String args[]) {
    
    
        //{"goods":{"goodsName":"daa","goodsId":"1111"},"id":19}
        String mapString = "{\"goods\":{\"goodsName\":\"daa\",\"goodsId\":\"1111\"},\"id\":19}";
        Map<String, Object> map = UtilJson.toMap(mapString);
        System.out.print(map);
        UtilJson.convertValue(map.get("goods"), Goods.class);
        String str = "{\"goodsName\":\"daa\",\"goodsId\":\"1111\"}";
        Goods goods = UtilJson.convertValue(str, Goods.class);
        System.out.print(goods);
    }
}

public class ApiGatewayServlet extends HttpServlet {
    
    
    private static final long serialVersionUID = 1L;
    ApplicationContext context;
    private ApiGatewayHand apiHand;

    @Override
    public void init() throws ServletException {
    
    
        super.init();
        context = WebApplicationContextUtils.getWebApplicationContext(getServletContext());
        apiHand = context.getBean(ApiGatewayHand.class);
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    
    
        apiHand.handle(request, response);
    }

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
    
    
        apiHand.handle(req, resp);
    }
}

service包下的类

@Service
//goodsServiceImpl 
public class GoodsServiceImpl {
    
    
	//无缝集成 
	@APIMapping(value = "bit.api.goods.add",useLogin = true)
	public Goods addGoods(Goods goods, Integer id, ApiRequest apiRequest){
    
    
		return goods;
	}

	@APIMapping("bit.api.goods.get")
	public Goods getGodds(Integer id){
    
    
		return new Goods("vvv","1111");
	}
	public static class Goods implements Serializable{
    
    
		private String goodsName;
		private String goodsId;
		public Goods(){
    
    

		}
		public Goods(String goodsName, String goodsId) {
    
    
			this.goodsName = goodsName;
			this.goodsId = goodsId;
		}

		public String getGoodsName() {
    
    
			return goodsName;
		}
		public void setGoodsName(String goodsName) {
    
    
			this.goodsName = goodsName;
		}
		public String getGoodsId() {
    
    
			return goodsId;
		}
		public void setGoodsId(String goodsId) {
    
    
			this.goodsId = goodsId;
		}
	}
}

common包下的类

public class ApiException extends Exception{
    
    
	private String code;

	public ApiException(String message) {
    
    
		super(message);
	}

	public ApiException( String code,String message) {
    
    
		super(message);
		this.code = code;
	}

	public String getCode() {
    
    
		return code;
	}

	public void setCode(String code) {
    
    
		this.code = code;
	}
}

    /**
     * 对字符串md5加密(大写+数字)
     *
     * @param s 传入要加密的字符串
     * @return MD5加密后的字符串
     */

    public static String MD5(String s) {
    
    
        char hexDigits[] = {
    
    '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'};

        try {
    
    
            byte[] btInput = s.getBytes();
            // 获得MD5摘要算法的 MessageDigest 对象
            MessageDigest mdInst = MessageDigest.getInstance("MD5");
            // 使用指定的字节更新摘要
            mdInst.update(btInput);
            // 获得密文
            byte[] md = mdInst.digest();
            // 把密文转换成十六进制的字符串形式
            int j = md.length;
            char str[] = new char[j * 2];
            int k = 0;
            for (int i = 0; i < j; i++) {
    
    
                byte byte0 = md[i];
                str[k++] = hexDigits[byte0 >>> 4 & 0xf];
                str[k++] = hexDigits[byte0 & 0xf];
            }
            return new String(str);
        } catch (Exception e) {
    
    
            e.printStackTrace();
            return null;
        }
    }

    public static void main(String[] args) {
    
    
        String md5 = MD5("password");
    }
}

import java.io.IOException;
import java.util.Map;

import org.springframework.util.StringUtils;

import com.fasterxml.jackson.annotation.JsonInclude.Include;
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.databind.DeserializationFeature;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializationFeature;

public class UtilJson {
    
    
	public static final ObjectMapper JSON_MAPPER = newObjectMapper(), JSON_MAPPER_WEB = newObjectMapper();

	private static ObjectMapper newObjectMapper() {
    
    
		ObjectMapper result = new ObjectMapper();
		result.configure(JsonParser.Feature.ALLOW_UNQUOTED_FIELD_NAMES, true);
		result.configure(JsonParser.Feature.ALLOW_SINGLE_QUOTES, true);
		result.setSerializationInclusion(Include.NON_NULL);
		result.configure(SerializationFeature.WRITE_NULL_MAP_VALUES, false);	//不输出value=null的属性
		result.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
        result.configure(JsonParser.Feature.ALLOW_UNQUOTED_CONTROL_CHARS, true);

		return result;
	}

	public static ObjectMapper getObjectMapper() {
    
    
		return JSON_MAPPER;
	}

	public static String writeValueAsString(Object value) {
    
    
		try {
    
    
			return value == null ? null : JSON_MAPPER.writeValueAsString(value);
		} catch (IOException e) {
    
    
			throw new IllegalArgumentException(e); // TIP: 原则上，不对异常包装，这里为什么要包装？因为正常情况不会发生IOException
		}
	}

	@SuppressWarnings("unchecked")
	public static Map<String, Object> toMap(Object value) throws IllegalArgumentException {
    
    
		return convertValue(value, Map.class);
	}
	
	
	public static <T> T convertValue(Object value, Class<T> clazz) throws IllegalArgumentException {
    
    
		if (StringUtils.isEmpty(value)) return null;
		try {
    
    
			if (value instanceof String) 
				value = JSON_MAPPER.readTree((String) value);
			return JSON_MAPPER.convertValue(value, clazz);
		} catch (IOException e) {
    
    
			throw new IllegalArgumentException(e);
		}
	}

	
	
}

6.开发API接口安全弱点

• 数据窃取:用户的密码等信息被不轨之人窃取，登录账号发布敏感信息，盗刷等
• 数据篡改:提交的数据被抓包后进行篡改再提交
• 数据泄露:爬虫将业务数据甚至核心数据抓取，直接或间接造成损失

7.开放API接口解决方案

(1) RSA/DES加密

对称加密: DES AES

非对称加密: RSA

(2) MD5混淆算法

• 信息摘要算法
• 不可逆
• 可以加盐，增加破解复杂性
• MD5流程

(3) TOKEN令牌

• 有令牌者过，无则拦截
• Token交互流程

史上最全的并发编程脑图：https://www.processon.com/view/5d43e6cee4b0e47199351b7f