wei.zhou

提交代码

......@@ -29,43 +29,45 @@ public class SignInterceptor extends HandlerInterceptorAdapter {
String timeStamp = (String) request.getHeader("TimeStamp");
String token = (String) request.getHeader("token");
//TODO 增加请求路径是否在权限里的判断
//String uri = request.getRequestURI();
if(StringUtils.isBlank(appId)){
this.returnJson(response,false,"-1","Appid 不能为空");
this.returnJson(response,false,"10016","Appid 不能为空");
return false;
}
if(StringUtils.isBlank(appkey)){
this.returnJson(response,false,"-2","Appkey 不能为空");
this.returnJson(response,false,"10017","Appkey 不能为空");
return false;
}
if(StringUtils.isBlank(timeStamp)){
this.returnJson(response,false,"-6","TimeStamp 不能为空");
this.returnJson(response,false,"10018","TimeStamp 不能为空");
return false;
}
if(StringUtils.isBlank(token)){
this.returnJson(response,false,"-4","token 不能为空");
this.returnJson(response,false,"10013","token 不能为空");
return false;
}
HashMap<String,String> secretMap = Constant.appIdSecurityCache.get(appId);
if(secretMap==null){
this.returnJson(response,false,"-100","系统异常,该appId没有注册");
this.returnJson(response,false,"10001","系统异常,该appId没有注册");
return false;
}
String secretInSys = secretMap.get(appkey);
if (StringUtils.isBlank(secretInSys)) {
this.returnJson(response,false,"-101","系统异常,该appId没有权限/密码");
this.returnJson(response,false,"10002","系统异常,该appId没有当前Appkey的权限");
return false;
}
String sha256Str = SHA256Util.getSHA256String(appId+appkey+secretInSys+timeStamp);
if(!token.equals(sha256Str)){
this.returnJson(response,false,"-4","Token验证失败");
this.returnJson(response,false,"10014","Token验证失败");
return false;
}
......