PHP常用框架如何实现API接口的签名验证 PHP常用框架接口安全的技巧

php artisan make:middleware VerifyApiSignature

handle

// app/Http/Middleware/VerifyApiSignature.php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class VerifyApiSignature
{
    public function handle(Request $request, Closure $next): Response
    {
        $clientId = $request->header('X-Client-Id'); // 假设客户端ID在请求头
        $receivedSignature = $request->header('X-Signature'); // 签名也在请求头
        $timestamp = $request->header('X-Timestamp');
        $nonce = $request->header('X-Nonce');

        if (!$clientId || !$receivedSignature || !$timestamp || !$nonce) {
            return response()->json(['message' => 'Missing signature headers'], 401);
        }

        // 1. 根据clientId从数据库或配置中获取对应的secretKey
        // 实际项目中这里需要查询数据库或缓存
        $secretKey = $this->getSecretKeyForClient($clientId);
        if (!$secretKey) {
            return response()->json(['message' => 'Invalid client ID'], 401);
        }

        // 2. 校验时间戳，防止重放攻击
        // 假设允许5分钟的偏差
        if (abs(time() - (int)$timestamp) > 300) {
            return response()->json(['message' => 'Request expired or clock skew'], 401);
        }

        // 3. 构造用于签名的原始字符串
        // 这里需要根据实际的签名规则来构造
        // 通常会包含请求方法、URI、所有参数（按字典序排序）、timestamp、nonce等
        $dataToSign = $this->buildDataToSign($request, $timestamp, $nonce);

        // 4. 计算服务器端签名
        $calculatedSignature = hash_hmac('sha256', $dataToSign, $secretKey);

        // 5. 比对签名
        if (!hash_equals($calculatedSignature, $receivedSignature)) { // 使用hash_equals防止时序攻击
            return response()->json(['message' => 'Invalid signature'], 401);
        }

        // 6. 校验Nonce，防止重复使用
        // 这里需要一个机制来存储和检查用过的Nonce，比如Redis
        if ($this->isNonceUsed($clientId, $nonce)) {
             return response()->json(['message' => 'Nonce already used'], 401);
        }
        $this->storeNonce($clientId, $nonce, $timestamp); // 存储Nonce

        return $next($request);
    }

    // 辅助方法，根据实际情况实现
    private function getSecretKeyForClient(string $clientId): ?string
    {
        // 示例：从配置中获取，实际应从数据库查询
        $keys = ['client_abc' => 'your_secret_key_for_abc', 'client_xyz' => 'another_secret_key'];
        return $keys[$clientId] ?? null;
    }

    private function buildDataToSign(Request $request, string $timestamp, string $nonce): string
    {
        // 这是一个示例，实际规则可能更复杂
        $params = $request->all(); // 获取所有请求参数
        ksort($params); // 对参数进行排序
        $queryString = http_build_query($params); // 转换为查询字符串
        $requestBody = $request->getContent(); // 获取原始请求体

        // 组合：请求方法 + URI + 查询字符串 + 请求体 + 时间戳 + Nonce
        return $request->method() . $request->path() . $queryString . $requestBody . $timestamp . $nonce;
    }

    private function isNonceUsed(string $clientId, string $nonce): bool
    {
        // 实际应该查询Redis或数据库
        // 简单示例：
        // return Cache::has("nonce:{$clientId}:{$nonce}");
        return false;
    }

    private function storeNonce(string $clientId, string $nonce, string $timestamp): void
    {
        // 实际应该存储到Redis或数据库，设置过期时间与时间戳校验一致
        // Cache::put("nonce:{$clientId}:{$nonce}", true, now()->addMinutes(5));
    }
}

app/Http/Kernel.php

// app/Http/Kernel.php
protected $routeMiddleware = [
    // ...
    'api.signed' => \App\Http\Middleware\VerifyApiSignature::class,
];

// routes/api.php
Route::middleware('api.signed')->group(function () {
    Route::get('/sensitive-data', [ApiController::class, 'getData']);
    Route::post('/process-order', [ApiController::class, 'processOrder']);
});

kernel.request

// src/EventListener/ApiSignatureListener.php

namespace App\EventListener;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\KernelEvents;

class ApiSignatureListener implements EventSubscriberInterface
{
    public function onKernelRequest(RequestEvent $event)
    {
        $request = $event->getRequest();

        // 检查是否是需要签名验证的API路由
        if (strpos($request->getPathInfo(), '/api/') !== 0) {
            return;
        }

        $clientId = $request->headers->get('X-Client-Id');
        $receivedSignature = $request->headers->get('X-Signature');
        $timestamp = $request->headers->get('X-Timestamp');
        $nonce = $request->headers->get('X-Nonce');

        if (!$clientId || !$receivedSignature || !$timestamp || !$nonce) {
            $event->setResponse(new JsonResponse(['message' => 'Missing signature headers'], Response::HTTP_UNAUTHORIZED));
            return;
        }

        // 实际的签名验证逻辑，与Laravel示例类似
        // ... (获取secretKey, 校验时间戳, 构造签名数据, 计算签名, 比对, Nonce校验)

        // 如果验证失败
        if (false /* 签名验证失败 */) {
            $event->setResponse(new JsonResponse(['message' => 'Invalid signature'], Response::HTTP_UNAUTHORIZED));
        }
    }

    public static function getSubscribedEvents()
    {
        return [
            KernelEvents::REQUEST => ['onKernelRequest', 10], // 优先级，确保在路由匹配后执行
        ];
    }
}

services.yaml

# config/services.yaml
services:
    App\EventListener\ApiSignatureListener:
        tags:
            - { name: kernel.event_subscriber }

beforeAction

// app/components/ApiSignatureBehavior.php

namespace app\components;

use yii\base\Behavior;
use yii\web\Controller;
use yii\web\Response;
use Yii;

class ApiSignatureBehavior extends Behavior
{
    public function events()
    {
        return [
            Controller::EVENT_BEFORE_ACTION => 'beforeAction',
        ];
    }

    public function beforeAction($event)
    {
        $request = Yii::$app->request;

        $clientId = $request->headers->get('X-Client-Id');
        $receivedSignature = $request->headers->get('X-Signature');
        $timestamp = $request->headers->get('X-Timestamp');
        $nonce = $request->headers->get('X-Nonce');

        if (!$clientId || !$receivedSignature || !$timestamp || !$nonce) {
            Yii::$app->response->format = Response::FORMAT_JSON;
            Yii::$app->response->data = ['message' => 'Missing signature headers'];
            Yii::$app->response->statusCode = 401;
            $event->isValid = false; // 阻止后续操作
            return false;
        }

        // 实际的签名验证逻辑，与Laravel示例类似
        // ... (获取secretKey, 校验时间戳, 构造签名数据, 计算签名, 比对, Nonce校验)

        if (false /* 签名验证失败 */) {
            Yii::$app->response->format = Response::FORMAT_JSON;
            Yii::$app->response->data = ['message' => 'Invalid signature'];
            Yii::$app->response->statusCode = 401;
            $event->isValid = false;
            return false;
        }

        return true;
    }
}

// 在控制器中使用
class MyApiController extends \yii\web\Controller
{
    public function behaviors()
    {
        return [
            'apiSignature' => [
                'class' => \app\components\ApiSignatureBehavior::class,
                // 可选：只对特定action生效
                // 'only' => ['index', 'create'],
            ],
        ];
    }

    public function actionIndex()
    {
        // ...
    }
}

throttle