background
Wednesday, 18:00.
Xiaoming twisted his sour neck and rubbed his dry eyes staring at the screen.
Finally finished busy, approaching to go off work, the whole heart has become relaxed.
“On the receiving side we need to provide a new service, next Tuesday online, demand I send you, very simple.”
A message from the product manager broke the good news.
“Screw me, every demand is coming at the end of the day.” Xiao Ming could not help but whisper in the heart, but the hand can not stop.
“Ok, LET me look at the demand first.”
After replying, I clicked on the requirements document, which was really simple.
Provides an interface for external counterparties to add merchants. Keep consistent with the new merchants in the internal console.Copy the codeIt is not too difficult, Xiao Ming thought, although the internal console new merchant is not their own, but the interface should be able to directly reuse, code should also be able to reuse.
However, I haven’t done external docking before, so I don’t know if there are other pits.
It’s going to be available next Tuesday, so next Monday you need to get the beta, get the beta involved.
Xiaoming turned on the calendar, today is Wednesday, his interface documentation, detailed design, coding and self-testing time is only two days.
Should have been sufficient, but usually there will be a variety of work chores need to deal with, will reduce the overall work efficiency.
Ask colleagues for old code and documentation first.
Seeing that it was already past the end of the day, Xiao Ming sighed.
Interface documentation
Document writing
Thursday, 9:30.
Xiaoming came to the company began to deal with the preparation of interface documents, with the previous document basis, write up or very fast.
However, the external interface is still somewhat different. Xiaoming added traceId, requestTime and other fields according to his own understanding to facilitate troubleshooting and locating problems.
The basic interface is then written:
Request parameters:
| The serial number | parameter | describe | If required | instructions |
|---|---|---|---|---|
| 1 | traceId | A unique identifier | is | A 32-bit string used to uniquely locate a request |
| 2 | requestTime | Request parameters | is | Request time, yyyyMMddHHmmssSSS 17-bit timestamp |
| 3 | username | The user name | is | The longest string is 64 characters |
| 4 | password | password | is | A string of up to 128 characters, encrypted by MD5 |
| 5 | address | address | no | A string of up to 128 characters |
Response parameters:
| The serial number | parameter | describe | If required | instructions |
|---|---|---|---|---|
| 1 | respCode | The response code | is | 000000 indicates success, for others, see enumeration of response encoding |
| 2 | respDesc | The response described | is | Request time, yyyyMMddHHmmssSSS 17-bit timestamp |
| 3 | userId | The user id | is | A string of 32 characters that uniquely identifies a user after a successful creation |
Xiaoming wrote down in detail the request mode of the whole interface, matters needing attention, as well as the corresponding enumeration values.
I also organized the basic detailed design documents.
1762 words, Xiao Ming looked at the total number of words, bitter smile.
This document, of course, is not as concise as the requirements document.
When I looked up, it was already 11:30. Boy, time flies.
So I booked a meeting room at 14:00 PM and prepared to go over documents with product manager, test manager and project manager.
Document review
Conference room 14:00.
Xiao Ming arrived at the meeting room on time, plugged in the projector in advance, and waited for everyone’s arrival.
“What I asked for yesterday was simple.” The product manager just arrived at the door and walked in with a smile.
“Yes, it’s fine.”
Then the project manager and the test come in.
“Hurry up with the requirements document,” said the project manager.
Little Ming qing cleared his throat and spoke about the overall project background. And put their own detailed design and interface documents over.
While the product manager is busy doing other things, these details don’t need to be addressed.
Listen to the test more seriously, constantly put forward their own questions, behind the need for their own verification.
“Any other questions?” Xiao Ming himself kept talking for more than half an hour, feeling a little boring.
“I have no more questions,” said the tester. “All I care about is when can I take the test?”
“Next Monday,” Mindy paused. “I don’t think I can start coding until after.”
“That’s fine,” the test replied, adding that he had no further questions.
“Your document is quite detailed”, the project manager looked at Xiao Ming with slightly approving eyes, “but there is a problem, your interface does not even have a signature.”
“Signature, what signature?” Xiao Ming is confused.
“You don’t even know the outgoing interface signature? I have time to learn.” The project manager was clearly disappointed.
“Well, that’s enough.” “The product manager then joined the conversation.” Is this simple requirement ok for next Tuesday?”
“There should be no problem, as long as you take the test on time.” The test looked at Xiao Ming.
“There should be no problem.” Xiao Ming was still thinking about the interface signature. “I will check the interface signature and adjust the interface.”
Interface signature
Signature role
Xiao Ming went to check and found that the external interface, security must be considered.
To ensure data security and prevent information from being tampered with, signature is a common method.
Signature implementation
There are many ways to achieve, the more common way:
(1) All parameters, except checkValue itself, are sorted alphabetically by parameter name.
(2) The sorted parameters are spliced into strings according to the way of parameters and values
(3) Md5 encryption is performed on the concatenated string using the key agreed by both parties to obtain checkValue
(4) Set the corresponding value to the checkValue property
Of course, there may be differences in the implementation of the signature, but the two sides should be consistent.
Signature verification
Know how to sign, check is similar.
Repeat steps (1) (2) (3) above to obtain the corresponding checkValue.
Then, the signature is compared with the value transmitted by the peer. If the value is the same, the signature is verified successfully.
Interface adjustment
After understanding the necessity of signatures, Ming added the checkValue attribute value to the interface document.
And a private communication with the test, at this point, the documentation is preliminary.
Seeing that it was already past the end of the day, Xiao Ming sighed.
Code implementation
v1
Friday, 10:00.
Xiao Ming came to the company began to code, other things almost after the processing, there is a signature implementation problem.
At first, I didn’t think much about it, but implemented it as follows:
/** * Manually build the verification result *@returnResults *@sinceHundreds * /
public String buildCheckValue(a) {
StringBuilder stringBuilder = new StringBuilder();
stringBuilder.append(name);
stringBuilder.append(password);
// A bunch of other attributes
return Md5Util.md5(stringBuilder.toString());
}
Copy the codeOf course, as a conservationist, Ming was aware of a problem.
There must be similar tool classes in other projects, so you shouldn’t duplicate the wheel.
V2 version
Copy a utility class from another application. The implementation is as follows:
import com.github.houbb.heaven.util.lang.StringUtil;
import com.github.houbb.heaven.util.lang.reflect.ClassUtil;
import com.github.houbb.heaven.util.lang.reflect.ReflectFieldUtil;
import com.github.houbb.heaven.util.secrect.Md5Util;
import java.lang.reflect.Field;
import java.util.*;
/ * * *@author binbin.hou
* @since1.0.0 * /
public class CheckValueUtils {
private CheckValueUtils(a){}
public static String buildCheckValue(Object object) { Class<? > clazz = object.getClass();// Get the fieldMap for all fields
Map<String, Field> fieldMap = ClassUtil.getAllFieldMap(clazz);
// Remove the checkValue name
fieldMap.remove("checkValue");
// Sort the fields by name
Set<String> fieldNameSet = fieldMap.keySet();
List<String> fieldNameList = new ArrayList<>(fieldNameSet);
Collections.sort(fieldNameList);
// Reflection gets all string values
StringBuilder stringBuilder = new StringBuilder();
for(String fieldName : fieldNameList) {
Object value = ReflectFieldUtil.getValue(fieldName, object);
// reflection gets the value
String valueStr = StringUtil.objectToString(value, "");
/ / stitching
stringBuilder.append(fieldName).append("=").append(valueStr);
}
/ / the signature of the md5
returnMd5Util.md5(stringBuilder.toString()); }}Copy the codeGenerally speaking, it is still very easy to use, and their time is not much, it is good to use directly.
After all done, is the self-test work, after a step pit, Xiaoming is the whole interface self-test through.
“In this way, it’s not too late for the test.”
Seeing that it was already past the end of the day, Xiao Ming sighed.
More elegant signing implementation
Normally, that’s where the story ends.
But an idea from Xiao Ming keeps the story going.
Deficiencies in the tool approach
The original method basically meets most of the requirements, but it can become cumbersome to adjust.
For example, if some very large fields are not checked, the name of the signed section is not checkValue, but changed to sign, adjust the way the fields are sorted, etc.
All these will lead to the original tool method is not available, need to copy, modify.
Is it possible to implement a more flexible checker tool?
The answer is yes, Xiao Ming spent 2 days over the weekend to implement a checkmark tool.
Quick start
Maven is introduced into
<plugin>
<groupId>com.github.houbb</groupId>
<artifactId>checksum</artifactId>
<version>0.0.6</version>
</plugin>
Copy the codePojo object
- User.java
public class User {
@CheckField
private String name;
private String password;
@CheckField(required = false)
private String address;
@CheckValue
private String checksum;
//Getter & Setter
//toString()
}
Copy the codeThere are two core notes:
@checkfield Indicates the field information that is checked. By default, the field information is checked. Specifying required=false skips the check-in.
@checkValue Indicates the field that stores the checkered result. The field type must be String.
Later, a String and different types of conversion implementation will be added to expand the application scenarios.
To get the signature
See ChecksumHelper for all utility class methods, and the following methods support specifying secret keys.
User user = User.buildUser();
final String checksum = ChecksumHelper.checkValue(user);
Copy the codeThis method processes all the @checkfield fields in the User object,
The final check result is constructed by combining the specified encryption policy with the specified collation.
Fill the signature
User user = User.buildUser();
ChecksumHelper.fill(user);
Copy the codeThe corresponding checkValue can be populated by default on the field specified by @checkValue.
Verify the signature
User user = User.buildUser();
boolean isValid = ChecksumHelper.isValid(user);
Copy the codeThe current User object is appended and the result is compared to the signature of the user itself.
The bootstrap class
ChecksumBs bootstrap class
To meet more flexible scenarios, we introduce ChecksumBs bootstrap class based on Fluent-API.
The default configuration above is equivalent to:
final String checksum = ChecksumBs
.newInstance()
.target(user)
.charset("UTF-8")
.checkSum(new DefaultChecksum())
.sort(Sorts.quick())
.hash(Hashes.md5())
.times(1)
.salt(null)
.checkFieldListCache(new CheckFieldListCache())
.checkValueCache(new CheckValueCache())
.checkValue();
Copy the codeConfiguration instructions
All of the above configurations are flexible and all implementations support user customization.
| attribute | instructions |
|---|---|
| target | Object to be signed |
| charset | coding |
| checkSum | Specific sign implementation |
| sort | Field sorting strategy |
| hash | String encryption HASH policy |
| salt | Encrypt the corresponding salt value |
| times | Number of encryptions |
| checkFieldListCache | Cache implementation of the segment to be signed |
| checkValueCache | Caching implementation of signature fields |
performance
background
Every time we talk about reflection the first response is convenience, the second response is performance.
Sometimes because of concerns about performance, and choose to manually copy and paste.
performance
See BenchmarkTest. Java
The 100W test verification takes the following time:
Manual processing time: 2505ms
Annotation processing time: 2927ms
summary
Signature During communication with external interfaces, the signature prevents information from being tampered with.
Hopefully this tool will help you get out of work on time.
I am old ma, looking forward to meeting with you next time.