js引數簽名和後臺驗證
為了保證引數傳輸的安全性,使用簽名方法處理
第一步:下載md5.min.js
第二步:簽名函式
/*
*設定引數簽名,按照引數key升序然後進行MD5加密,返回引數
*/
setParamSign = function (params) {
var paramStr = "";
if (typeof params == "string") {
paramStr = params;
}
else if (typeof params == "object") {
var arr = [];
for (var i in params) {
if (params.hasOwnProperty(i)) {
arr.push((i + "=" + params[i]));
}
}
paramStr = arr.join(("&"));
}
if (paramStr) {
var newParamStr = paramStr.split("&").sort().join("&");
console.log(newParamStr);
var sign = md5(newParamStr);
if (typeof params == "string") {
params += ("&sign=" + sign);
}
else {
params["sign"] = sign;
}
}
return params;
}
第三部:呼叫簽名函式
var params = {
userName: $("#userName").textbox("getValue"),
mobile: $("#mobile").textbox("getValue"),
phone: $("#phone").textbox("getValue"),
eMail: $("#eMail").textbox("getValue"),
postCode: $("#postCode").textbox("getValue"),
address: $("#address").textbox("getValue")
};
$.ajax({
url: "submit",
cache: false,
async: false,
data: setParamSign(params),
dataType: "json",
type: "POST",
success: function (data) { });
第四部 後臺過濾器處理
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
var isAjax = filterContext.HttpContext.Request.IsAjaxRequest();
var paraList = new Dictionary<string, object>();
HttpRequest paramRequest = System.Web.HttpContext.Current.Request;
var queryString = paramRequest.QueryString;
var form = paramRequest.Form;
var isRightSign = false;
if (queryString != null && queryString.Count > 0)
{
foreach (var item in queryString)
{
var key = item.ToString();
if (!paraList.ContainsKey(key))
{
paraList.Add(key, queryString[key]);
}
}
}
if (form != null && form.Count > 0)
{
foreach (var item in form)
{
var key = item.ToString();
if (!paraList.ContainsKey(key))
{
paraList.Add(key, form[key]);
}
}
}
if (paraList.ContainsKey("gwtsign"))
{
var requestGwtSign = paraList["sign"];
var ascParaList = paraList.OrderBy(o => o.Key).ToDictionary(o => o.Key, p => p.Value);
var paraStr = "";
foreach (var paraDic in ascParaList)
{
if (paraDic.Key != "sign")
{
var strValue = "";
if (paraDic.Value != null)
strValue = paraDic.Value.ToString();
paraStr += $"{paraDic.Key}={strValue}&";
}
}
if (paraStr.EndsWith("&"))
paraStr = paraStr.Substring(0, paraStr.Length - 1);
var thisSign= Md5Hash(paraStr);
if (thisSign == paraList["sign"].ToString())
isRightSign = true;
var errorMsg = "引數簽名校驗失敗";
if (!isRightSign)
{
if (isAjax)
{
filterContext.HttpContext.Response.StatusCode = 403;
filterContext.HttpContext.Response.AddHeader("errorMsg", "wrongsign");
filterContext.Result = new JsonResult
{
Data = new { Message = errorMsg },
JsonRequestBehavior = JsonRequestBehavior.AllowGet
};
filterContext.HttpContext.Response.End();
}
else
{
filterContext.Result = new ContentResult
{
Content = @" <script>toastr.error('" + errorMsg + @"');</script>"
};
}
}
}
}
/// <summary>
/// 32位MD5加密
/// </summary>
/// <param name="input"></param>
/// <returns></returns>
private static string Md5Hash(string input)
{
MD5CryptoServiceProvider md5Hasher = new MD5CryptoServiceProvider();
byte[] data = md5Hasher.ComputeHash(Encoding.UTF8.GetBytes(input));
StringBuilder sBuilder = new StringBuilder();
for (int i = 0; i < data.Length; i++)
{
sBuilder.Append(data[i].ToString("x2"));
}
return sBuilder.ToString();
}
注意一下MD5的js加密和C#加密分16和32位的,要不加密結果不一致