详解API接口如何安全的传输数据( 二 )

2025-12-28 API

该抽象类中提供了2中对称加密的密钥还原，分表是AES和DES算法。一个抽象方法，该抽象方法
keySpec该方法需要子类实现（具体使用的是哪种对称加密算法）。
具体加密算法的实现类
AESAlgorithmpublic class AESAlgorithm extends AbstractSecretProcess {@Overridepublic String getAlgorithm() {return "AES/ECB/PKCS5Padding";}@Overridepublic Key keySpec() {return this.getKeySpec("AES") ;}}SecretProperties@Configurationpublic class SecretConfig {@Bean@ConditionalOnMissingBean(SecretProcess.class)public SecretProcess secretProcess() {return new AESAlgorithm() ;}@Component@ConfigurationProperties(prefix = "secret")public static class SecretProperties {private Boolean enabled ;private String key ;public Boolean getEnabled() {return enabled;}public void setEnabled(Boolean enabled) {this.enabled = enabled;}public String getKey() {return key;}public void setKey(String key) {this.key = key;}}}配置文件中如下配置：
secret:key: aaaabbbbccccdddd #密钥enabled: true #是否开启加解密功能在项目中可能不是所有的方法都要进行数据的加密解密出来，所以接下来定义一个注解，只有添加有该注解的Controller类或是具体接口方法才进行数据的加密解密，如下：
SIProtection@Target({ElementType.METHOD, ElementType.TYPE})@Retention(RetentionPolicy.RUNTIME)@Mapping@Documentedpublic @interface SIProtection {}对请求内容进行解密出来，通过RequestBodyAdvice
DecryptRequestBodyAdivce@ControllerAdvice@ConditionalOnProperty(name = "secret.enabled", havingValue = https://www.isolves.com/it/cxkf/bk/2023-08-28/"true")public class DecryptRequestBodyAdivce extends RequestBodyAdviceAdapter {@Resourceprivate SecretProcess secretProcess ;@Overridepublic boolean supports(MethodParameter methodParameter, Type targetType,Class> converterType) {return methodParameter.getMethod().isAnnotationPresent(SIProtection.class)|| methodParameter.getMethod().getDeclaringClass().isAnnotationPresent(SIProtection.class) ;}@Overridepublic HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage, MethodParameter parameter, Type targetType,Class> converterType) throws IOException {String body = secretProcess.decrypt(inToString(inputMessage.getBody())) ;return new HttpInputMessage() {@Overridepublic HttpHeaders getHeaders() {return inputMessage.getHeaders();}@Overridepublic InputStream getBody() throws IOException {return new ByteArrayInputStream(body.getBytes()) ;}} ;}private String inToString(InputStream is) {byte[] buf = new byte[10 * 1024] ;int leng = -1 ;StringBuilder sb = new StringBuilder() ;try {while ((leng = is.read(buf)) != -1) {sb.append(new String(buf, 0, leng)) ;}return sb.toString() ;} catch (IOException e) {throw new RuntimeException(e) ;}}}注意这里的：@ConditionalOnProperty(name = "secret.enabled", havingValue = https://www.isolves.com/it/cxkf/bk/2023-08-28/"true")注解，只有开启了加解密功能才会生效。注意这里的supports方法
对响应内容加密出来
EncryptResponseBodyAdivce@ControllerAdvice@ConditionalOnProperty(name = "secret.enabled", havingValue = https://www.isolves.com/it/cxkf/bk/2023-08-28/"true")public class EncryptResponseBodyAdivce implements ResponseBodyAdvice