WebApi服务Uri加密及验证的两种方式

最近的一个项目要求服务端与UI层分离，业务层以WebApi方式向外提供所有业务服务，服务在数据保密性方面提出了要求，主要包括：

1：客户端认证；

2：服务请求超时（默认5分钟）；

3：服务Get请求的参数密文传输。

以上三个需求为一般的网络服务比较常见的简单要求，在WebApi项目中也比较容易实现，以下是我采用的两种实现方式（任意一种即可）：

一：继承HttpClient来加入数据（Uri）加密，加入验证Header，继承ApiController来对Header进行合法性验证，并解密Uri

客户端的关键代码包括对HttpClient继承实现：

    public class MyHttpClient : HttpClient
    {
        private static MyHttpClient _myClient;

        public static MyHttpClient Instance
        {
            get
            {
                if(_myClient!=null)return _myClient;
                _myClient = new MyHttpClient();
                _myClient.DefaultRequestHeaders.Add("Mac", MacMd5);
                return _myClient;
            }
        }

        private MyHttpClient()
        {
        }

        private static readonly IAuthorize _authorize = new MacAuthorize();
        private static string _macMd5 = string.Empty;

        private static string MacMd5
        {
            get
            {
                if (!string.IsNullOrEmpty(_macMd5)) return _macMd5;
                var macAddress = _authorize.UniqueId;
                if (string.IsNullOrEmpty(macAddress)) return string.Empty;
                _macMd5 = macAddress.GetMD5();
                return _macMd5;
            }
        }

        private static string TimeAes
        {
            get
            {
                var time = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss");
                var aesTime = time.AesEncrypt();
                return aesTime;
            }
        }

        private static void AddHeader(ref string url)
        {
            var segs = url.Split('/');
            var para = segs[segs.Length - 1];
            if (para.Contains("="))
            {
                var aes = para.AesEncrypt();
                url = url.Replace(para, aes.GetMD5());
                IEnumerable<string> p = new List<string>();
                if (_myClient.DefaultRequestHeaders.TryGetValues("Param", out p))
                    _myClient.DefaultRequestHeaders.Remove("Param");
                _myClient.DefaultRequestHeaders.Add("Param",aes);
            }

            IEnumerable<string> time = new List<string>();
            if (_myClient.DefaultRequestHeaders.TryGetValues("Time", out time))
                _myClient.DefaultRequestHeaders.Remove("Time");
            _myClient.DefaultRequestHeaders.Add("Time", TimeAes);
        }

        public override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
            System.Threading.CancellationToken cancellationToken)
        {
            var url = request.RequestUri.AbsoluteUri;
            AddHeader(ref url);
            return base.SendAsync(request, cancellationToken);
        }

        public override int GetHashCode()
        {
            return _myClient.GetHashCode();
        }

    }

其中时间戳为了简便，未转为ms格式进行验证，仅作为字符串进行了验证。

在客户端进行调用时，通过继承的MyHttpClient发送服务请求即可：

var client = MyHttpClient.Instance;
var response = client.GetAsync(urlBase.AbsoluteUri + "api/test/GetUser/id=123123&name=jiakai").Result;

服务端的关键代码包括对ApiController的继承实现：

    public class BaseApiController : ApiController
    {
        protected override void Initialize(HttpControllerContext controllerContext)
        {
            base.Initialize(controllerContext);
            //获取请求头信息
            var requestHeader = controllerContext.Request.Headers;
            IEnumerable<string> mac = new List<string>();
            requestHeader.TryGetValues("Mac", out mac);
            IEnumerable<string> time = new List<string>();
            requestHeader.TryGetValues("Time", out time);
            IEnumerable<string> para = new List<string>();
            requestHeader.TryGetValues("Param", out para);
            var paramList = controllerContext.Request.RequestUri.AbsoluteUri.Split('/');
            if (mac == null || time == null || para == null)
            {
                var resp = Request.CreateResponse<string>(HttpStatusCode.Forbidden, "非法请求", "application/json");
                throw new HttpResponseException(resp);
            }
            //验证机器MAC地址
            if (mac.Any()&&!string.IsNullOrEmpty(mac.First()))
            {
                //TODO:验证机器MAC地址是否为已注册MAC地址
            }
            //验证时间戳
            if (time.Any() && !string.IsNullOrEmpty(time.First()))
            {
                var t = Convert.ToDateTime(time.First().AesDecrypt());
                if (t.AddMinutes(5) < DateTime.Now)
                {
                    var resp = Request.CreateResponse<string>(HttpStatusCode.RequestTimeout, "请求过期", "application/json");
                    throw new HttpResponseException(resp);
                }
            }
            //验证参数MD5
            if (para.Any() && !string.IsNullOrEmpty(para.First()))
            {
                var newMd5 = paramList[paramList.Length - 1];
                if (para.First().GetMD5() != newMd5)
                {
                    var resp = Request.CreateResponse<string>(HttpStatusCode.Forbidden, "参数MD5验证失败", "application/json");
                    throw new HttpResponseException(resp);
                }
            }
        }
    }

同样，在业务实现的Controller中，继承改为BaseApiController即可：

public class TestController : BaseApiController
{
    //TODO:业务服务具体实现
}

二：通过对WebApi消息处理框架中HttpMessageHandler的自定义实现，并分别注入到Request及Response的消息处理阶段，来实现加密/解密的功能

客户端HttpClient中HttpMessageHandler的实现：

    public class RequestHandler : DelegatingHandler
    {
        private static string TimeAes
        {
            get
            {
                var time = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss");
                var aesTime = time.AesEncrypt();
                return aesTime;
            }
        }

        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
            System.Threading.CancellationToken cancellationToken)
        {
            var uri = request.RequestUri.AbsoluteUri;
            var port = request.RequestUri.Port;
            var para = uri.Split('/').Last();
            if (para.Contains("="))
            {
                var aes = para.AesEncrypt();
                uri = uri.Replace(para, aes.GetMD5());
                IEnumerable<string> p = new List<string>();
                if (request.Headers.TryGetValues("Param", out p))
                    request.Headers.Remove("Param");
                request.Headers.Add("Param", aes);
            }
            IEnumerable<string> time = new List<string>();
            if (request.Headers.TryGetValues("Time", out time))
                request.Headers.Remove("Time");
            request.Headers.Add("Time", TimeAes);
            request.RequestUri = new Uri(uri);

            return base.SendAsync(request, cancellationToken);
        }
    }

在实现了自定义的HttpMessageHandler后，实现一个HttpClient工厂，对外提供一个注入了该HttpMessageHandler的HttpClient单例对象：

    public class AtmHttpClientFactory
    {
        private static HttpClient _atmClient;
        private readonly static HttpClientHandler ClientHandler = new HttpClientHandler();

        public static HttpClient GetClient()
        {
            if (_atmClient != null) return _atmClient;
            _atmClient = new HttpClient(new RequestHandler() {InnerHandler = ClientHandler });
            _atmClient.DefaultRequestHeaders.Add("Mac", MacMd5);
            return _atmClient;
        }

        private AtmHttpClientFactory()
        {
        }

        private static readonly IAuthorize _authorize = new MacAuthorize();
        private static string _macMd5 = String.Empty;

        private static string MacMd5
        {
            get
            {
                if (!String.IsNullOrEmpty(_macMd5)) return _macMd5;
                var macAddress = _authorize.UniqueId;
                if (String.IsNullOrEmpty(macAddress)) return String.Empty;
                _macMd5 = macAddress.GetMD5();
                return _macMd5;
            }
        }
    }

这样，在客户端的调用加密过程就完全被封装，简化为如下：

     //调用实现1
     var myClient = AtmHttpClientFactory.GetClient();
     var myResponse = myClient.GetAsync("http://api.ezbatm.com:7777/api/test/GetUser/id=123123&name=jiakai").Result;

服务端也是类似的方法，在app的config中注入我们自己实现的服务端HttpMessageHandler即可。response的HttpMessageHandler实现：

    public class ResponseHandler : DelegatingHandler
    {
        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
            System.Threading.CancellationToken cancellationToken)
        {
            //获取请求头信息
            IEnumerable<string> mac = new List<string>();
            request.Headers.TryGetValues("Mac", out mac);
            IEnumerable<string> time = new List<string>();
            request.Headers.TryGetValues("Time", out time);
            IEnumerable<string> para = new List<string>();
            request.Headers.TryGetValues("Param", out para);
            var paramList = request.RequestUri.AbsoluteUri.Split('/');
            //验证Header是否完整
            if (mac == null || time == null || para == null)
            {
                return RequestNotAcceptable();
            }
            //验证机器MAC地址
            if (mac.Any() && !string.IsNullOrEmpty(mac.First()))
            {
                //TODO:验证机器MAC地址是否为已注册MAC地址
            }
            //验证时间戳
            if (time.Any() && !string.IsNullOrEmpty(time.First()))
            {
                var t = Convert.ToDateTime(time.First().AesDecrypt());
                if (t.AddMinutes(5) < DateTime.Now)
                {
                    return RequestTimeOut();
                }
            }
            //验证参数MD5
            if (para.Any() && !string.IsNullOrEmpty(para.First()))
            {
                var newMd5 = paramList[paramList.Length - 1];
                //if (para.First().GetMD5() != newMd5)
                {
                    return RequestForbidden();
                }
            }
            return base.SendAsync(request, cancellationToken);
        }

        private static Task<HttpResponseMessage> RequestForbidden()
        {
            return Task.Factory.StartNew(() =>
            {
                return new HttpResponseMessage(HttpStatusCode.Forbidden)
                {
                    Content = new StringContent("请求未通过认证")
                };
            });
        }

        private static Task<HttpResponseMessage> RequestTimeOut()
        {
            return Task.Factory.StartNew(() =>
            {
                return new HttpResponseMessage(HttpStatusCode.RequestTimeout)
                {
                    Content = new StringContent("请求已超时")
                };
            });
        }

        private static Task<HttpResponseMessage> RequestNotAcceptable()
        {
            return Task.Factory.StartNew(() =>
            {
                return new HttpResponseMessage(HttpStatusCode.NotAcceptable)
                {
                    Content = new StringContent("请求为非法请求")
                };
            });
        }
    }    

之后，在(owin框架)Startup中注入该自定义HttpMessageHandler即可：

        public void Configuration(IAppBuilder app)
        {            
            // Configure Web API for self-host. 
            var config = new HttpConfiguration();
            config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{action}/{param}",
                defaults: new { id = RouteParameter.Optional }
            );
            //注入response handler
            config.MessageHandlers.Add(new ResponseHandler());

            app.UseWebApi(config);
        }

完成了以上客户端+服务器端的工作后，即可按照我们的实际需求对Request及Response消息进行自定义的处理。

总结：以上两种方法中，客户端及服务器端的方案都是解耦的，也就是是，你可以采用方法一的客户端方案+方法二的服务器端方案，等等以此类推。