#region
|
using System;
|
using System.Collections.Generic;
|
using System.Collections.Specialized;
|
using System.Data.SqlClient;
|
using System.IO;
|
using System.Linq;
|
using System.Net;
|
using System.Net.Http;
|
using System.Text;
|
using System.Web;
|
using System.Web.Caching;
|
using System.Web.Http;
|
using System.Web.Http.Controllers;
|
using Newtonsoft.Json;
|
using Rattan.Basic.Utility;
|
using Rattan.BasicInfo.Data;
|
using Rattan.BasicInfo.DomainModel;
|
using Rattan.Core.DomainModel;
|
using Rattan.Sys.Data;
|
#endregion
|
|
namespace iWareSda_QQJF.WEBAPI.TestPost
|
{
|
/// <summary>
|
/// 权限验证
|
/// </summary>
|
public class ApiCheckAuthAttribute : AuthorizeAttribute
|
{
|
#region
|
/// <summary>
|
/// 身份验证特性类
|
/// </summary>
|
/// <param name="actionContext"></param>
|
public override void OnAuthorization(HttpActionContext actionContext)
|
{
|
var request = actionContext.Request;
|
var apitype = "api";
|
if (request.Headers.Contains("apiType"))
|
{
|
apitype = request.Headers.GetValues("apiType").FirstOrDefault();
|
}
|
if (apitype.ToLower() == "app")
|
{
|
AppAuth(actionContext);
|
}
|
else if (apitype.ToLower() == "consignor")
|
{
|
ConsignorAuth(actionContext);
|
}
|
else
|
{
|
ApiAuth(actionContext);
|
}
|
}
|
#endregion
|
|
#region ApiAuth
|
/// <summary>
|
/// 内部API接口
|
/// </summary>
|
/// <param name="actionContext"></param>
|
private void ApiAuth(HttpActionContext actionContext)
|
{
|
//GetToken方法不需要进行签名验证
|
if ("GetValidateCode,GetToken,Login,LoginUser".SplitEx().Contains(actionContext.ActionDescriptor.ActionName))
|
{
|
return;
|
}
|
|
var actionName = actionContext.ActionDescriptor.ActionName;
|
var type = actionContext.ActionDescriptor.ControllerDescriptor.ControllerType;
|
var m = type.GetMethod(actionName);
|
var attrs = m.GetCustomAttributes(false);
|
var noCheckAuth = false;
|
attrs.All(obj =>
|
{
|
Attribute attr = (System.Attribute)obj;
|
string name = attr.GetType().Name;
|
if (name == "NoCheckAuthAttribute")
|
{
|
noCheckAuth = true;
|
}
|
return true;
|
});
|
if (noCheckAuth) return;
|
|
ResultMsg resultMsg = null;
|
var request = actionContext.Request;
|
string guid = String.Empty, timestamp = string.Empty, nonce = string.Empty,
|
signature = string.Empty, AccessToken = string.Empty;
|
string method = request.Method.Method;
|
if (request.Method == HttpMethod.Options)
|
{
|
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Accepted);
|
return;
|
}
|
if (request.Headers.Contains("guid"))
|
{
|
guid = HttpUtility.UrlDecode(request.Headers.GetValues("guid").FirstOrDefault());
|
}
|
|
var accessTokenKey = "AccessToken_" + guid;
|
var signTokenKey = "Token_" + guid;
|
if (request.Headers.Contains("AccessToken"))
|
{
|
//客户端授权Token
|
AccessToken = HttpUtility.UrlDecode(request.Headers.GetValues("AccessToken").FirstOrDefault());
|
if (AccessToken.IsNullOrEmpty())
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-客户端未获取到授权";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
var _AccessTokenServer = RedisHelper.Cache.Read<LoginInfo>(accessTokenKey, 2);// HttpRuntime.Cache[accessTokenKey];
|
//如果缓存没有，在去访问日志里获取
|
if (_AccessTokenServer == null)
|
{
|
var where = "GUID=@GUID";
|
var paramList = new List<SqlParameter>();
|
paramList.Add(new SqlParameter("@GUID", guid));
|
var log = Sys_User_LogRepository.Instance.Get(where, "Log_Id DESC", paramList.ToArray());
|
if (log != null && log.LoginInfo.IsNotNullOrEmpty())
|
{
|
if (log.LoginInfo.IsNotNullOrEmpty())
|
{
|
_AccessTokenServer = JsonHelper.ConvertJson<LoginInfo>(log.LoginInfo);
|
RedisHelper.Cache.Write(accessTokenKey, _AccessTokenServer, DateTime.Now.AddDays(30), 2);
|
// HttpRuntime.Cache.Insert(accessTokenKey, _AccessTokenServer, null, Cache.NoAbsoluteExpiration, TimeSpan.FromMinutes(20));
|
}
|
|
if (log.SignTokenInfo.IsNotNullOrEmpty())
|
{
|
var signTokenInfo = JsonHelper.ConvertJson<Token>(log.SignTokenInfo);
|
RedisHelper.Cache.Write(signTokenKey, signTokenInfo, DateTime.Now.AddDays(30), 2);
|
//HttpRuntime.Cache.Insert(signTokenKey, signTokenInfo, null, Cache.NoAbsoluteExpiration, TimeSpan.FromMinutes(20));
|
}
|
}
|
}
|
|
if (_AccessTokenServer != null)
|
{
|
var platUserInfo = _AccessTokenServer as LoginInfo;
|
if (platUserInfo == null || platUserInfo.AccessToken != AccessToken)
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-客户端授权不正确";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
actionContext.Response.StatusCode = HttpStatusCode.Unauthorized;
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
}
|
else
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-服务器授权不存在";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
actionContext.Response.StatusCode = HttpStatusCode.Unauthorized;
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
}
|
else
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-客户端未获取到授权";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
if (request.Headers.Contains("timestamp"))
|
{
|
timestamp = HttpUtility.UrlDecode(request.Headers.GetValues("timestamp").FirstOrDefault());
|
}
|
if (request.Headers.Contains("nonce"))
|
{
|
nonce = HttpUtility.UrlDecode(request.Headers.GetValues("nonce").FirstOrDefault());
|
}
|
|
if (request.Headers.Contains("signature"))
|
{
|
signature = HttpUtility.UrlDecode(request.Headers.GetValues("signature").FirstOrDefault());
|
}
|
|
//判断请求头是否包含以下参数
|
if (string.IsNullOrEmpty(guid) || string.IsNullOrEmpty(timestamp) || string.IsNullOrEmpty(nonce) || string.IsNullOrEmpty(signature))
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.ParameterError;
|
resultMsg.Msg = StatusCodeEnum.ParameterError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
//判断timespan是否有效
|
double ts1 = 0;
|
double ts2 = (DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, 0)).TotalMilliseconds;
|
bool timespanvalidate = double.TryParse(timestamp, out ts1);
|
double ts = ts2 - ts1;
|
bool falg = ts > 8 * 60 * 1000; //2小时有效
|
if (falg || (!timespanvalidate))
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.URLExpireError;
|
resultMsg.Msg = StatusCodeEnum.URLExpireError.GetEnumText();
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
|
//判断token是否有效
|
string cacheKey = "Token_" + guid;
|
Token token = RedisHelper.Cache.Read<Token>(cacheKey, 2); // (Token)HttpRuntime.Cache.Get(cacheKey);
|
string signtoken = string.Empty;
|
if (token == null)
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.TokenInvalid;
|
resultMsg.Msg = StatusCodeEnum.TokenInvalid.GetEnumText();
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
actionContext.Response.StatusCode = HttpStatusCode.Forbidden;
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
else
|
{
|
signtoken = token.SignToken.ToString();
|
}
|
|
//根据请求类型拼接参数
|
NameValueCollection queryString = HttpContext.Current.Request.QueryString;
|
string data = string.Empty;
|
switch (method)
|
{
|
case "POST":
|
Stream stream = HttpContext.Current.Request.InputStream;
|
string responseJson = string.Empty;
|
StreamReader streamReader = new StreamReader(stream);
|
data = streamReader.ReadToEnd();
|
break;
|
case "GET":
|
//第一步：取出所有get参数
|
IDictionary<string, string> parameters = new Dictionary<string, string>();
|
for (int f = 0; f < queryString.Count; f++)
|
{
|
string key = queryString.Keys[f];
|
parameters.Add(key, queryString[key]);
|
}
|
|
// 第二步：把字典按Key的字母顺序排序
|
IDictionary<string, string> sortedParams = new SortedDictionary<string, string>(parameters);
|
IEnumerator<KeyValuePair<string, string>> dem = sortedParams.GetEnumerator();
|
|
// 第三步：把所有参数名和参数值串在一起
|
StringBuilder query = new StringBuilder();
|
while (dem.MoveNext())
|
{
|
string key = dem.Current.Key;
|
string value = dem.Current.Value;
|
if (!string.IsNullOrEmpty(key))
|
{
|
query.Append(key).Append(value);
|
}
|
}
|
data = query.ToString();
|
break;
|
default:
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.HttpMehtodError;
|
resultMsg.Msg = StatusCodeEnum.HttpMehtodError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
//转义常规字符
|
//data = HttpContext.Current.Server.UrlDecode(data);
|
var dataJson = JsonHelper.ConvertJson(data);
|
var _data = data;
|
// 数据不参数签名计算
|
if (dataJson.noDataSign==true)
|
{
|
_data = "";
|
}
|
bool result = SignExtension.Validate(timestamp, nonce, guid, signtoken, _data, signature);
|
if (!result)
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.HttpRequestError;
|
resultMsg.Msg = StatusCodeEnum.HttpRequestError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
}
|
#endregion
|
|
#region AppAuth
|
/// <summary>
|
/// 外部API接口
|
/// </summary>
|
/// <param name="actionContext"></param>
|
private void AppAuth(HttpActionContext actionContext)
|
{
|
//GetToken方法不需要进行签名验证
|
if ("GetValidateCode,GetToken,Login,LoginUser".SplitEx().Contains(actionContext.ActionDescriptor.ActionName))
|
{
|
return;
|
}
|
|
var actionName = actionContext.ActionDescriptor.ActionName;
|
var type = actionContext.ActionDescriptor.ControllerDescriptor.ControllerType;
|
var m = type.GetMethod(actionName);
|
var attrs = m.GetCustomAttributes(false);
|
var noCheckAuth = false;
|
attrs.All(obj =>
|
{
|
Attribute attr = (System.Attribute)obj;
|
string name = attr.GetType().Name;
|
if (name == "NoCheckAuthAttribute")
|
{
|
noCheckAuth = true;
|
}
|
return true;
|
});
|
if (noCheckAuth) return;
|
|
ResultMsg resultMsg = null;
|
var request = actionContext.Request;
|
string guid = String.Empty, timestamp = string.Empty, nonce = string.Empty,
|
signature = string.Empty, accessToken = string.Empty, appSecret = string.Empty, appKey = string.Empty;
|
string method = request.Method.Method;
|
if (request.Method == HttpMethod.Options)
|
{
|
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Accepted);
|
return;
|
}
|
if (request.Headers.Contains("guid"))
|
{
|
guid = HttpUtility.UrlDecode(request.Headers.GetValues("guid").FirstOrDefault());
|
}
|
|
var accessTokenKey = "AccessToken_" + guid;
|
var signTokenKey = "Token_" + guid;
|
if (request.Headers.Contains("AccessToken"))
|
{
|
//客户端授权Token
|
accessToken = HttpUtility.UrlDecode(request.Headers.GetValues("AccessToken").FirstOrDefault());
|
if (accessToken.IsNullOrEmpty())
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-客户端未获取到授权";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
var _AccessTokenServer = RedisHelper.Cache.Read<LoginInfo>(accessTokenKey, 2);// HttpRuntime.Cache[accessTokenKey];
|
//如果缓存没有，在去访问日志里获取
|
if (_AccessTokenServer == null)
|
{
|
var where = "GUID=@GUID";
|
var paramList = new List<SqlParameter>();
|
paramList.Add(new SqlParameter("@GUID", guid));
|
var log = Sys_User_LogRepository.Instance.Get(where, "Log_Id DESC", paramList.ToArray());
|
if (log != null && log.LoginInfo.IsNotNullOrEmpty())
|
{
|
if (log.LoginInfo.IsNotNullOrEmpty())
|
{
|
_AccessTokenServer = JsonHelper.ConvertJson<LoginInfo>(log.LoginInfo);
|
RedisHelper.Cache.Write(accessTokenKey, _AccessTokenServer, DateTime.Now.AddDays(30), 2);
|
//HttpRuntime.Cache.Insert(accessTokenKey, _AccessTokenServer, null, Cache.NoAbsoluteExpiration, TimeSpan.FromMinutes(20));
|
}
|
|
if (log.SignTokenInfo.IsNotNullOrEmpty())
|
{
|
var signTokenInfo = JsonHelper.ConvertJson<Token>(log.SignTokenInfo);
|
RedisHelper.Cache.Write(signTokenKey, signTokenInfo, DateTime.Now.AddDays(30), 2);
|
//HttpRuntime.Cache.Insert(signTokenKey, signTokenInfo, null, Cache.NoAbsoluteExpiration, TimeSpan.FromMinutes(20));
|
}
|
}
|
}
|
|
if (_AccessTokenServer != null)
|
{
|
var platUserInfo = _AccessTokenServer as LoginInfo;
|
if (platUserInfo == null || platUserInfo.AccessToken != accessToken)
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-客户端授权不正确";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
actionContext.Response.StatusCode = HttpStatusCode.Unauthorized;
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
}
|
else
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-服务器授权不存在";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
actionContext.Response.StatusCode = HttpStatusCode.Unauthorized;
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
}
|
else
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.Unauthorized;
|
resultMsg.Msg = StatusCodeEnum.Unauthorized.GetEnumText() + "-客户端未获取到授权";
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
if (request.Headers.Contains("timestamp"))
|
{
|
timestamp = HttpUtility.UrlDecode(request.Headers.GetValues("timestamp").FirstOrDefault());
|
}
|
if (request.Headers.Contains("nonce"))
|
{
|
nonce = HttpUtility.UrlDecode(request.Headers.GetValues("nonce").FirstOrDefault());
|
}
|
|
if (request.Headers.Contains("appSecret"))
|
{
|
appSecret = HttpUtility.UrlDecode(request.Headers.GetValues("appSecret").FirstOrDefault());
|
}
|
if (request.Headers.Contains("appKey"))
|
{
|
appKey = HttpUtility.UrlDecode(request.Headers.GetValues("appKey").FirstOrDefault());
|
}
|
if (request.Headers.Contains("signature"))
|
{
|
signature = HttpUtility.UrlDecode(request.Headers.GetValues("signature").FirstOrDefault());
|
}
|
|
//判断请求头是否包含以下参数
|
if (string.IsNullOrEmpty(guid) || string.IsNullOrEmpty(timestamp) || string.IsNullOrEmpty(nonce) || string.IsNullOrEmpty(signature))
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.ParameterError;
|
resultMsg.Msg = StatusCodeEnum.ParameterError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
//判断timespan是否有效
|
double ts1 = 0;
|
double ts2 = (DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, 0)).TotalMilliseconds;
|
bool timespanvalidate = double.TryParse(timestamp, out ts1);
|
double ts = ts2 - ts1;
|
bool falg = ts > 8 * 60 * 1000; //2小时有效
|
if (falg || (!timespanvalidate))
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.URLExpireError;
|
resultMsg.Msg = StatusCodeEnum.URLExpireError.GetEnumText();
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
|
//根据请求类型拼接参数
|
NameValueCollection queryString = HttpContext.Current.Request.QueryString;
|
string data = string.Empty;
|
switch (method)
|
{
|
case "POST":
|
Stream stream = HttpContext.Current.Request.InputStream;
|
string responseJson = string.Empty;
|
StreamReader streamReader = new StreamReader(stream);
|
data = streamReader.ReadToEnd();
|
break;
|
case "GET":
|
//第一步：取出所有get参数
|
IDictionary<string, string> parameters = new Dictionary<string, string>();
|
for (int f = 0; f < queryString.Count; f++)
|
{
|
string key = queryString.Keys[f];
|
parameters.Add(key, queryString[key]);
|
}
|
|
// 第二步：把字典按Key的字母顺序排序
|
IDictionary<string, string> sortedParams = new SortedDictionary<string, string>(parameters);
|
IEnumerator<KeyValuePair<string, string>> dem = sortedParams.GetEnumerator();
|
|
// 第三步：把所有参数名和参数值串在一起
|
StringBuilder query = new StringBuilder();
|
while (dem.MoveNext())
|
{
|
string key = dem.Current.Key;
|
string value = dem.Current.Value;
|
if (!string.IsNullOrEmpty(key))
|
{
|
query.Append(key).Append(value);
|
}
|
}
|
data = query.ToString();
|
break;
|
default:
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.HttpMehtodError;
|
resultMsg.Msg = StatusCodeEnum.HttpMehtodError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
//格式化JSON，去掉空格
|
data = JsonHelper.ConvertJsonStringNone(data);
|
bool result = SignExtension.ValidateApp(timestamp, nonce, appKey, appSecret, accessToken, data, signature);
|
if (!result)
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.HttpRequestError;
|
resultMsg.Msg = StatusCodeEnum.HttpRequestError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
}
|
#endregion
|
|
#region ConsignorAuth
|
/// <summary>
|
/// 货主调用API接口
|
/// </summary>
|
/// <param name="actionContext"></param>
|
private void ConsignorAuth(HttpActionContext actionContext)
|
{
|
var actionName = actionContext.ActionDescriptor.ActionName;
|
var type = actionContext.ActionDescriptor.ControllerDescriptor.ControllerType;
|
var m = type.GetMethod(actionName);
|
var attrs = m.GetCustomAttributes(false);
|
var noCheckAuth = false;
|
attrs.All(obj =>
|
{
|
Attribute attr = (System.Attribute)obj;
|
string name = attr.GetType().Name;
|
if (name == "NoCheckAuthAttribute")
|
{
|
noCheckAuth = true;
|
}
|
return true;
|
});
|
if (noCheckAuth) return;
|
|
ResultMsg resultMsg = null;
|
var request = actionContext.Request;
|
string token = string.Empty, timestamp = string.Empty, nonce = string.Empty,
|
signature = string.Empty, consignorCode = string.Empty;
|
string method = request.Method.Method;
|
if (request.Method == HttpMethod.Options)
|
{
|
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Accepted);
|
return;
|
}
|
if (request.Headers.Contains("token"))
|
{
|
token = HttpUtility.UrlDecode(request.Headers.GetValues("token").FirstOrDefault());
|
}
|
|
if (request.Headers.Contains("timestamp"))
|
{
|
timestamp = HttpUtility.UrlDecode(request.Headers.GetValues("timestamp").FirstOrDefault());
|
}
|
if (request.Headers.Contains("nonce"))
|
{
|
nonce = HttpUtility.UrlDecode(request.Headers.GetValues("nonce").FirstOrDefault());
|
}
|
if (request.Headers.Contains("consignorCode"))
|
{
|
consignorCode = HttpUtility.UrlDecode(request.Headers.GetValues("consignorCode").FirstOrDefault());
|
}
|
|
if (request.Headers.Contains("signature"))
|
{
|
signature = HttpUtility.UrlDecode(request.Headers.GetValues("signature").FirstOrDefault());
|
}
|
|
//判断请求头是否包含以下参数
|
if (string.IsNullOrEmpty(consignorCode) || string.IsNullOrEmpty(token) || string.IsNullOrEmpty(timestamp)
|
|| string.IsNullOrEmpty(nonce) || string.IsNullOrEmpty(signature))
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.ParameterError;
|
resultMsg.Msg = StatusCodeEnum.ParameterError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
//判断timespan是否有效
|
double ts1 = 0;
|
double ts2 = (DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, 0)).TotalMilliseconds;
|
bool timespanvalidate = double.TryParse(timestamp, out ts1);
|
double ts = ts2 - ts1;
|
bool falg = ts > 8 * 60 * 1000; //2小时有效
|
if (falg || (!timespanvalidate))
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.URLExpireError;
|
resultMsg.Msg = StatusCodeEnum.URLExpireError.GetEnumText();
|
resultMsg.Data = null;
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
//根据请求类型拼接参数
|
NameValueCollection queryString = HttpContext.Current.Request.QueryString;
|
string data = string.Empty;
|
switch (method)
|
{
|
case "POST":
|
Stream stream = HttpContext.Current.Request.InputStream;
|
string responseJson = string.Empty;
|
StreamReader streamReader = new StreamReader(stream);
|
data = streamReader.ReadToEnd();
|
break;
|
case "GET":
|
//第一步：取出所有get参数
|
IDictionary<string, string> parameters = new Dictionary<string, string>();
|
for (int f = 0; f < queryString.Count; f++)
|
{
|
string key = queryString.Keys[f];
|
parameters.Add(key, queryString[key]);
|
}
|
|
// 第二步：把字典按Key的字母顺序排序
|
IDictionary<string, string> sortedParams = new SortedDictionary<string, string>(parameters);
|
IEnumerator<KeyValuePair<string, string>> dem = sortedParams.GetEnumerator();
|
|
// 第三步：把所有参数名和参数值串在一起
|
StringBuilder query = new StringBuilder();
|
while (dem.MoveNext())
|
{
|
string key = dem.Current.Key;
|
string value = dem.Current.Value;
|
if (!string.IsNullOrEmpty(key))
|
{
|
query.Append(key).Append(value);
|
}
|
}
|
data = query.ToString();
|
break;
|
default:
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.HttpMehtodError;
|
resultMsg.Msg = StatusCodeEnum.HttpMehtodError.GetEnumText();
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
//格式化JSON，去掉空格
|
data = JsonHelper.ConvertJsonStringNone(data);
|
bool result = SignExtension.ValidateConsignor(timestamp, nonce, consignorCode, token, data, signature);
|
if (!result)
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.HttpRequestError;
|
resultMsg.Msg = "签名不合法";
|
resultMsg.Data = "";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
|
//验证账号是否正确
|
var where = "ConsignorCode=@ConsignorCode And Token=@Token";
|
var paramList = new SqlParameter[]
|
{
|
new SqlParameter("@ConsignorCode", consignorCode),
|
new SqlParameter("@Token", token),
|
};
|
var signTokenKey = "ConsignorToken_" + token;
|
var conInfo = RedisHelper.Cache.Read<Base_Consignor>(signTokenKey, 2); // (Base_Consignor)HttpRuntime.Cache[signTokenKey];
|
if (conInfo == null)
|
{
|
conInfo = Base_ConsignorRepository.Instance.Get(where, paramList);
|
if (conInfo != null)
|
{
|
RedisHelper.Cache.Write(signTokenKey, conInfo, DateTime.Now.AddDays(30), 2);
|
//HttpRuntime.Cache.Insert(signTokenKey, conInfo, null, Cache.NoAbsoluteExpiration, TimeSpan.FromMinutes(20));
|
}
|
}
|
|
if (conInfo == null)
|
{
|
resultMsg = new ResultMsg();
|
resultMsg.StatusCode = (int)StatusCodeEnum.ConsignorError;
|
resultMsg.Msg = "货主账号不正确";
|
actionContext.Response = HttpResponseExtension.toJson(JsonConvert.SerializeObject(resultMsg));
|
base.OnAuthorization(actionContext);
|
return;
|
}
|
}
|
#endregion
|
|
#region HandleUnauthorizedRequest
|
protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
|
{
|
var resp = actionContext.Response;
|
base.HandleUnauthorizedRequest(actionContext);
|
|
var response = actionContext.Response = actionContext.Response ?? new HttpResponseMessage();
|
response.StatusCode = resp.StatusCode;
|
response.Content = resp.Content;
|
}
|
#endregion
|
}
|
}
|
