Class SignVerifier

java.lang.Object

tech.riemann.nif.web.sign.SignVerifier

public class SignVerifier
extends Object

签名验证器

负责验证请求签名的有效性

验证流程： 1. 提取所有请求参数 2. 根据算法获取对应的签名生成器 3. 使用密钥验证签名

Author:

Kerbores(kerbores@riemann.tech)

Constructor Summary

Constructors

Constructor	Description
SignVerifier(List<SignGenerator> signGenerators, AppSecretProvider appSecretProvider)
SignVerifier(List<SignGenerator> signGenerators, AppSecretProvider appSecretProvider, AppKeyProvider appKeyProvider)

Method Summary

Modifier and Type	Method	Description
Map<String,String>	extractParams(jakarta.servlet.http.HttpServletRequest request)	从HttpServletRequest提取参数
String	getSecret(String appId)	获取应用密钥
boolean	verify(Map<String,String> params, String sign, String appId, SignAlgorithm algorithm, String timestamp, String requestPath, String nonce)	验证签名

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SignVerifier

public SignVerifier(List<SignGenerator> signGenerators,
 AppSecretProvider appSecretProvider)

SignVerifier

public SignVerifier(List<SignGenerator> signGenerators,
 AppSecretProvider appSecretProvider,
 AppKeyProvider appKeyProvider)

Method Details

verify

public boolean verify(Map<String,String> params,
 String sign,
 String appId,
 SignAlgorithm algorithm,
 String timestamp,
 String requestPath,
 String nonce)

验证签名

策略路由： - 对称算法（HMAC / SM3）使用 AppSecretProvider 取出的 secret； - 非对称算法（SM2 / RSA）使用 AppKeyProvider 取出的公钥验签。

Parameters:

params - 请求参数

sign - 签名值

appId - 应用ID

algorithm - 签名算法

timestamp - 时间戳（秒）

requestPath - 请求路径

nonce - 随机字符串

Returns:

验证通过返回 true

extractParams

public Map<String,String> extractParams(jakarta.servlet.http.HttpServletRequest request)

从HttpServletRequest提取参数

Parameters:

request - HTTP请求

Returns:

参数Map

getSecret

public String getSecret(String appId)

获取应用密钥

Parameters:

appId - 应用ID

Returns:

密钥