Golang实现接口签名校验方法详解

<strong>package main</strong>

<strong>import</strong> (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "net/http"
    "sort"
    "strings"
)

// 生成签名字符串
func generateSignature(params map[string]string, secret string) string {
    // 获取所有键并排序
    var keys []string
    for k := range params {
        if k != "sign" { // 排除 sign 字段
            keys = append(keys, k)
        }
    }
    sort.Strings(keys)

    // 拼接待签名字符串
    var str strings.Builder
    for _, k := range keys {
        str.WriteString(k)
        str.WriteString("=")
        str.WriteString(params[k])
        str.WriteString("&")
    }
    data := strings.TrimSuffix(str.String(), "&")

    // 使用 HMAC-SHA256 签名
    h := hmac.New(sha256.New, []byte(secret))
    h.Write([]byte(data))
    return hex.EncodeToString(h.Sum(nil))
}

// 中间件：校验签名
func SignAuthMiddleware(secret string, next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        // 解析查询参数
        r.ParseForm()
        params := make(map[string]string)
        for k, v := range r.Form {
            if len(v) > 0 {
                params[k] = v[0]
            }
        }

        // 检查必要字段
        timestamp := params["timestamp"]
        nonce := params["nonce"]
        clientSign := params["sign"]

        if timestamp == "" || nonce == "" || clientSign == "" {
            http.Error(w, "Missing required parameters", http.StatusBadRequest)
            return
        }

        // 时间戳防重放（例如：5分钟内有效）
        // 这里简化处理，实际应转换为时间对比
        // if time.Now().Unix()-atoi(timestamp) > 300 { ... }

        // 生成服务端签名
        serverSign := generateSignature(params, secret)

        // 安全比较
        if !hmac.Equal([]byte(serverSign), []byte(clientSign)) {
            http.Error(w, "Invalid signature", http.StatusUnauthorized)
            return
        }

        next(w, r)
    }
}

func main() {
    http.HandleFunc("/api/data", SignAuthMiddleware("your-secret-key", func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("Hello, authenticated user!"))
    }))

    http.ListenAndServe(":8080", nil)
}

GET /api/data?timestamp=1712345678&nonce=abc123&name=zhangsan&sign=a1b2c3d4...