Home >
Article > Java > Three ways to implement interface verification in Java
Three ways to implement interface verification in Java
黄舟Original
2017-10-19 09:29:081915browse
This article mainly introduces the three ways to implement interface verification in Java. The editor thinks it is quite good. Now I will share it with you and give it as a reference. Let’s follow the editor and take a look.
This article introduces three ways to implement interface verification in Java, mainly including AOP and MVC interceptors. I share them with you. The details are as follows:
Method 1: AOP
The code defines a permission annotation as follows
package com.thinkgem.jeesite.common.annotation;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
/**
* 权限注解
* Created by Hamming on 2016/12/
*/
@Target(ElementType.METHOD)//这个注解是应用在方法上
@Retention(RetentionPolicy.RUNTIME)
public @interface AccessToken {
/* String userId();
String token();*/
}
#1. Define a query parent class, which contains two attributes: authToken and usedId. All query parameters that need to be verified for user requests are inherited. The reason why this query parent class has this userId is because after we verify the user, we need to obtain some user data based on the user ID, so we backfill this parameter at the AOP layer, so that it will not affect the previous Code logic (this may be related to my business requirements)
public class AuthSearchVO {
public String authToken; //校验字符串
public Integer userId; //APP用户Id
public final String getAuthToken() {
return authToken;
}
public final void setAuthToken(String authToken) {
this.authToken = authToken;
}
public final Integer getUserId() {
return userId;
}
public final void setUserId(Integer userId) {
this.userId = userId;
}
@Override
public String toString() {
return "SearchVO [authToken=" + authToken + ", userId=" + userId + "]";
}
}
2. Define a method-level annotation, and add this annotation to all requests that need to be verified. Used for AOP interception (of course you can also intercept requests from all controllers)
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface AuthToken {
String type();
}
3. AOP processing, the reason why annotations are passed in as parameters is because Considering that there may be multiple APP verifications, you can use the type attribute of the annotation to distinguish
public class AuthTokenAOPInterceptor {
@Resource
private AppUserService appUserService;
private static final String authFieldName = "authToken";
private static final String userIdFieldName = "userId";
public void before(JoinPoint joinPoint, AuthToken authToken) throws Throwable{
Object[] args = joinPoint.getArgs(); //获取拦截方法的参数
boolean isFound = false;
for(Object arg : args){
if(arg != null){
Class clazz = arg.getClass();//利用反射获取属性值
Field[] fields = clazz.getDeclaredFields();
int authIndex = -1;
int userIdIndex = -1;
for(int i = 0; i < fields.length; i++){
Field field = fields[i];
field.setAccessible(true);
if(authFieldName.equals(field.getName())){//包含校验Token
authIndex = i;
}else if(userIdFieldName.equals(field.getName())){//包含用户Id
userIdIndex = i;
}
}
if(authIndex >= 0 & userIdIndex >= 0){
isFound = true;
authTokenCheck(fields[authIndex], fields[userIdIndex], arg, authToken);//校验用户
break;
}
}
}
if(!isFound){
throw new BizException(ErrorMessage.CHECK_AUTHTOKEN_FAIL);
}
}
private void authTokenCheck(Field authField, Field userIdField, Object arg, AuthToken authToken) throws Exception{
if(String.class == authField.getType()){
String authTokenStr = (String)authField.get(arg);//获取到校验Token
AppUser user = appUserService.getUserByAuthToken(authTokenStr);
if(user != null){
userIdField.set(arg, user.getId());
}else{
throw new BizException(ErrorMessage.CHECK_AUTHTOKEN_FAIL);
}
}
}
}
4. The last step is to configure this AOP in the configuration file (because Our spring version is slightly different from the aspect version, so the annotation-based method cannot be used)
Finally, the test code is given, such code is much more elegant
@RequestMapping(value = "/appointments", method = { RequestMethod.GET })
@ResponseBody
@AuthToken(type="disticntApp")
public List getAppointments(AppointmentSearchVo appointmentSearchVo) {
List appointments = appointmentService.getAppointment(appointmentSearchVo.getUserId(), appointmentSearchVo);
return appointments;
}
Method three: MVC interceptor
Server:
Splice everything except token Parameters, finally splice token_key, do MD5, and compare with token parameters
If the token comparison fails, return status code 500
public class APIInterceptor extends HandlerInterceptorAdapter {
@Override
public boolean preHandle(HttpServletRequest request,
HttpServletResponse response, Object handler) throws Exception {
Log.info(request);
String token = request.getParameter("token");
// token is not needed when debug
if(token == null) return true; // !! remember to comment this when deploy on server !!
Enumeration paraKeys = request.getParameterNames();
String encodeStr = "";
while (paraKeys.hasMoreElements()) {
String paraKey = (String) paraKeys.nextElement();
if(paraKey.equals("token"))
break;
String paraValue = request.getParameter(paraKey);
encodeStr += paraValue;
}
encodeStr += Default.TOKEN_KEY;
Log.out(encodeStr);
if ( ! token.equals(DigestUtils.md5Hex(encodeStr))) {
response.setStatus(500);
return false;
}
return true;
}
@Override
public void postHandle(HttpServletRequest request,
HttpServletResponse response, Object handler,
ModelAndView modelAndView) throws Exception {
Log.info(request);
}
@Override
public void afterCompletion(HttpServletRequest request,
HttpServletResponse response, Object handler, Exception ex)
throws Exception {
}
}
spring-config.xml Add
to the configuration. Client:
Splice all the parameters of the request interface, and finally splice token_key, do MD5, and use it as the token parameter
api test page, using Bootstrap and AngularJS, There is also a js hex_md5 function
API test
Search:
token_key
md5 {{md5(str)}}
The above is the detailed content of Three ways to implement interface verification in Java. For more information, please follow other related articles on the PHP Chinese website!
Statement：
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
