API接口安全加密详解：四种关键防护模式全面分析

// Java SpringBoot 实现IP白名单过滤器示例
@Component
public class IpWhitelistFilter extends OncePerRequestFilter {
    
    @Value("${api.ip.whitelist}")
    private List<String> ipWhitelist;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                   HttpServletResponse response, 
                                   FilterChain filterChain) throws ServletException, IOException {
        
        String clientIp = extractClientIp(request);
        
        if (!ipWhitelist.contains(clientIp)) {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.getWriter().write("Access denied: IP not in whitelist");
            return;
        }
        
        filterChain.doFilter(request, response);
    }
    
    private String extractClientIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        return ip;
    }
}

// Java SpringBoot 实现签名验证
@Service
public class SignatureVerificationService {
    
    @Value("${api.secret.key}")
    private String secretKey;
    
    public boolean verifySignature(Map<String, String> params) {
        // 获取客户端签名
        String clientSign = params.get("sign");
        if (clientSign == null) {
            return false;
        }
        
        // 验证时间戳，防止重放攻击
        long timestamp = Long.parseLong(params.get("timestamp"));
        if (System.currentTimeMillis() - timestamp > 5 * 60 * 1000) { // 5分钟有效期
            return false;
        }
        
        // 生成服务端签名
        String serverSign = generateSignature(params, secretKey);
        
        // 比对签名
        return clientSign.equals(serverSign);
    }
    
    private String generateSignature(Map<String, String> params, String secretKey) {
        // 实现与客户端一致的签名算法
        // ...
    }
}

// Java使用JJWT库生成JWT
@Service
public class JwtService {
    
    @Value("${jwt.secret}")
    private String jwtSecret;
    
    @Value("${jwt.expiration}")
    private long jwtExpiration;
    
    public String generateToken(UserDetails userDetails) {
        Map<String, Object> claims = new HashMap<>();
        // 可添加自定义信息
        claims.put("role", userDetails.getAuthorities());
        
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + jwtExpiration))
                .signWith(SignatureAlgorithm.HS256, jwtSecret)
                .compact();
    }
    
    public boolean validateToken(String token, UserDetails userDetails) {
        final String username = extractUsername(token);
        return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }
    
    public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }
    
    private <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = extractAllClaims(token);
        return claimsResolver.apply(claims);
    }
    
    private Claims extractAllClaims(String token) {
        return Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(token).getBody();
    }
    
    private Boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }
    
    private Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }
}

// Java SpringBoot 实现AES解密
@Service
public class EncryptionService {
    
    @Value("${api.encryption.key}")
    private String encryptionKey;
    
    public String decryptBody(String encryptedData, String iv) throws Exception {
        SecretKeySpec keySpec = new SecretKeySpec(encryptionKey.getBytes(), "AES");
        IvParameterSpec ivSpec = new IvParameterSpec(Base64.getDecoder().decode(iv));
        
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec);
        
        byte[] decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(encryptedData));
        return new String(decryptedBytes, StandardCharsets.UTF_8);
    }
}

@RestController
@RequestMapping("/api/payment")
public class PaymentController {
    
    @Autowired
    private EncryptionService encryptionService;
    
    @PostMapping("/process")
    public ResponseEntity<?> processPayment(@RequestBody EncryptedRequest request) {
        try {
            // 解密请求体
            String decryptedBody = encryptionService.decryptBody(request.getData(), request.getIv());
            
            // 将解密后的JSON转为对象
            ObjectMapper mapper = new ObjectMapper();
            PaymentRequest paymentRequest = mapper.readValue(decryptedBody, PaymentRequest.class);
            
            // 处理支付逻辑
            // ...
            
            return ResponseEntity.ok(new ApiResponse("Payment processed successfully"));
        } catch (Exception e) {
            return ResponseEntity.badRequest().body(new ApiResponse("Decryption failed"));
        }
    }
}