WebApi服务Uri加密及验证的两种方式

最近的一个项目要求服务端与UI层分离，业务层以WebApi方式向外提供所有业务服务，服务在数据保密性方面提出了要求，主要包括：

1：客户端认证；

2：服务请求超时（默认5分钟）；

3：服务Get请求的参数密文传输。

以上三个需求为一般的网络服务比较常见的简单要求，在WebApi项目中也比较容易实现，以下是我采用的两种实现方式（任意一种即可）：

一：继承HttpClient来加入数据（Uri）加密，加入验证Header，继承ApiController来对Header进行合法性验证，并解密Uri

客户端的关键代码包括对HttpClient继承实现：

     public class MyHttpClient : HttpClient
     {
         private static MyHttpClient _myClient;

         public static MyHttpClient Instance
         {
             get
             {
                 if(_myClient!=null)return _myClient;
                 _myClient = new MyHttpClient();
                 _myClient.DefaultRequestHeaders.Add("Mac", MacMd5);
                 return _myClient;
             }
         }

         private MyHttpClient()
         {
         }

         private static readonly IAuthorize _authorize = new MacAuthorize();
         private static string _macMd5 = string.Empty;

         private static string MacMd5
         {
             get
             {
                 if (!string.IsNullOrEmpty(_macMd5)) return _macMd5;
                 var macAddress = _authorize.UniqueId;
                 if (string.IsNullOrEmpty(macAddress)) return string.Empty;
                 _macMd5 = macAddress.GetMD5();
                 return _macMd5;
             }
         }

         private static string TimeAes
         {
             get
             {
                 var time = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss");
                 var aesTime = time.AesEncrypt();
                 return aesTime;
             }
         }

         private static void AddHeader(ref string url)
         {
             var segs = url.Split('/');
             ];
             if (para.Contains("="))
             {
                 var aes = para.AesEncrypt();
                 url = url.Replace(para, aes.GetMD5());
                 IEnumerable<string> p = new List<string>();
                 if (_myClient.DefaultRequestHeaders.TryGetValues("Param", out p))
                     _myClient.DefaultRequestHeaders.Remove("Param");
                 _myClient.DefaultRequestHeaders.Add("Param",aes);
             }

             IEnumerable<string> time = new List<string>();
             if (_myClient.DefaultRequestHeaders.TryGetValues("Time", out time))
                 _myClient.DefaultRequestHeaders.Remove("Time");
             _myClient.DefaultRequestHeaders.Add("Time", TimeAes);
         }

         public override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
             System.Threading.CancellationToken cancellationToken)
         {
             var url = request.RequestUri.AbsoluteUri;
             AddHeader(ref url);
             return base.SendAsync(request, cancellationToken);
         }

         public override int GetHashCode()
         {
             return _myClient.GetHashCode();
         }

     }

其中时间戳为了简便，未转为ms格式进行验证，仅作为字符串进行了验证。

在客户端进行调用时，通过继承的MyHttpClient发送服务请求即可：

 var client = MyHttpClient.Instance;
 var response = client.GetAsync(urlBase.AbsoluteUri + "api/test/GetUser/id=123123&name=jiakai").Result;

服务端的关键代码包括对ApiController的继承实现：

     public class BaseApiController : ApiController
     {
         protected override void Initialize(HttpControllerContext controllerContext)
         {
             base.Initialize(controllerContext);
             //获取请求头信息
             var requestHeader = controllerContext.Request.Headers;
             IEnumerable<string> mac = new List<string>();
             requestHeader.TryGetValues("Mac", out mac);
             IEnumerable<string> time = new List<string>();
             requestHeader.TryGetValues("Time", out time);
             IEnumerable<string> para = new List<string>();
             requestHeader.TryGetValues("Param", out para);
             var paramList = controllerContext.Request.RequestUri.AbsoluteUri.Split('/');
             if (mac == null || time == null || para == null)
             {
                 var resp = Request.CreateResponse<string>(HttpStatusCode.Forbidden, "非法请求", "application/json");
                 throw new HttpResponseException(resp);
             }
             //验证机器MAC地址
             if (mac.Any()&&!string.IsNullOrEmpty(mac.First()))
             {
                 //TODO:验证机器MAC地址是否为已注册MAC地址
             }
             //验证时间戳
             if (time.Any() && !string.IsNullOrEmpty(time.First()))
             {
                 var t = Convert.ToDateTime(time.First().AesDecrypt());
                 ) < DateTime.Now)
                 {
                     var resp = Request.CreateResponse<string>(HttpStatusCode.RequestTimeout, "请求过期", "application/json");
                     throw new HttpResponseException(resp);
                 }
             }
             //验证参数MD5
             if (para.Any() && !string.IsNullOrEmpty(para.First()))
             {
                 ];
                 if (para.First().GetMD5() != newMd5)
                 {
                     var resp = Request.CreateResponse<string>(HttpStatusCode.Forbidden, "参数MD5验证失败", "application/json");
                     throw new HttpResponseException(resp);
                 }
             }
         }
     }

同样，在业务实现的Controller中，继承改为BaseApiController即可：

 public class TestController : BaseApiController
 {
     //TODO:业务服务具体实现
 }

二：通过对WebApi消息处理框架中HttpMessageHandler的自定义实现，并分别注入到Request及Response的消息处理阶段，来实现加密/解密的功能

客户端HttpClient中HttpMessageHandler的实现：

     public class RequestHandler : DelegatingHandler
     {
         private static string TimeAes
         {
             get
             {
                 var time = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss");
                 var aesTime = time.AesEncrypt();
                 return aesTime;
             }
         }

         protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
             System.Threading.CancellationToken cancellationToken)
         {
             var uri = request.RequestUri.AbsoluteUri;
             var port = request.RequestUri.Port;
             var para = uri.Split('/').Last();
             if (para.Contains("="))
             {
                 var aes = para.AesEncrypt();
                 uri = uri.Replace(para, aes.GetMD5());
                 IEnumerable<string> p = new List<string>();
                 if (request.Headers.TryGetValues("Param", out p))
                     request.Headers.Remove("Param");
                 request.Headers.Add("Param", aes);
             }
             IEnumerable<string> time = new List<string>();
             if (request.Headers.TryGetValues("Time", out time))
                 request.Headers.Remove("Time");
             request.Headers.Add("Time", TimeAes);
             request.RequestUri = new Uri(uri);

             return base.SendAsync(request, cancellationToken);
         }
     }

在实现了自定义的HttpMessageHandler后，实现一个HttpClient工厂，对外提供一个注入了该HttpMessageHandler的HttpClient单例对象：

     public class AtmHttpClientFactory
     {
         private static HttpClient _atmClient;
         private readonly static HttpClientHandler ClientHandler = new HttpClientHandler();

         public static HttpClient GetClient()
         {
             if (_atmClient != null) return _atmClient;
             _atmClient = new HttpClient(new RequestHandler() {InnerHandler = ClientHandler });
             _atmClient.DefaultRequestHeaders.Add("Mac", MacMd5);
             return _atmClient;
         }

         private AtmHttpClientFactory()
         {
         }

         private static readonly IAuthorize _authorize = new MacAuthorize();
         private static string _macMd5 = String.Empty;

         private static string MacMd5
         {
             get
             {
                 if (!String.IsNullOrEmpty(_macMd5)) return _macMd5;
                 var macAddress = _authorize.UniqueId;
                 if (String.IsNullOrEmpty(macAddress)) return String.Empty;
                 _macMd5 = macAddress.GetMD5();
                 return _macMd5;
             }
         }
     }

这样，在客户端的调用加密过程就完全被封装，简化为如下：

      //调用实现1
      var myClient = AtmHttpClientFactory.GetClient();
      var myResponse = myClient.GetAsync("http://api.ezbatm.com:7777/api/test/GetUser/id=123123&name=jiakai").Result;

服务端也是类似的方法，在app的config中注入我们自己实现的服务端HttpMessageHandler即可。response的HttpMessageHandler实现：

     public class ResponseHandler : DelegatingHandler
     {
         protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
             System.Threading.CancellationToken cancellationToken)
         {
             //获取请求头信息
             IEnumerable<string> mac = new List<string>();
             request.Headers.TryGetValues("Mac", out mac);
             IEnumerable<string> time = new List<string>();
             request.Headers.TryGetValues("Time", out time);
             IEnumerable<string> para = new List<string>();
             request.Headers.TryGetValues("Param", out para);
             var paramList = request.RequestUri.AbsoluteUri.Split('/');
             //验证Header是否完整
             if (mac == null || time == null || para == null)
             {
                 return RequestNotAcceptable();
             }
             //验证机器MAC地址
             if (mac.Any() && !string.IsNullOrEmpty(mac.First()))
             {
                 //TODO:验证机器MAC地址是否为已注册MAC地址
             }
             //验证时间戳
             if (time.Any() && !string.IsNullOrEmpty(time.First()))
             {
                 var t = Convert.ToDateTime(time.First().AesDecrypt());
                 ) < DateTime.Now)
                 {
                     return RequestTimeOut();
                 }
             }
             //验证参数MD5
             if (para.Any() && !string.IsNullOrEmpty(para.First()))
             {
                 ];
                 //if (para.First().GetMD5() != newMd5)
                 {
                     return RequestForbidden();
                 }
             }
             return base.SendAsync(request, cancellationToken);
         }

         private static Task<HttpResponseMessage> RequestForbidden()
         {
             return Task.Factory.StartNew(() =>
             {
                 return new HttpResponseMessage(HttpStatusCode.Forbidden)
                 {
                     Content = new StringContent("请求未通过认证")
                 };
             });
         }

         private static Task<HttpResponseMessage> RequestTimeOut()
         {
             return Task.Factory.StartNew(() =>
             {
                 return new HttpResponseMessage(HttpStatusCode.RequestTimeout)
                 {
                     Content = new StringContent("请求已超时")
                 };
             });
         }

         private static Task<HttpResponseMessage> RequestNotAcceptable()
         {
             return Task.Factory.StartNew(() =>
             {
                 return new HttpResponseMessage(HttpStatusCode.NotAcceptable)
                 {
                     Content = new StringContent("请求为非法请求")
                 };
             });
         }
     }    

之后，在(owin框架)Startup中注入该自定义HttpMessageHandler即可：

         public void Configuration(IAppBuilder app)
         {
             // Configure Web API for self-host.
             var config = new HttpConfiguration();
             config.Routes.MapHttpRoute(
                 name: "DefaultApi",
                 routeTemplate: "api/{controller}/{action}/{param}",
                 defaults: new { id = RouteParameter.Optional }
             );
             //注入response handler
             config.MessageHandlers.Add(new ResponseHandler());

             app.UseWebApi(config);
         }

完成了以上客户端+服务器端的工作后，即可按照我们的实际需求对Request及Response消息进行自定义的处理。

总结：以上两种方法中，客户端及服务器端的方案都是解耦的，也就是是，你可以采用方法一的客户端方案+方法二的服务器端方案，等等以此类推。