【接口安全设计】接口实现

这个章节主要内容是使用SpringBoot实现HTTP基本的GET和POST请求，其中POST常用的有两种，一种Body类型是x-www-form-urlencoded的，一种是json的。

# 新建Restful项目

使用Spring Initializr项目生成器，新建一个Web->Spring Web项目。

# 新建Controller

新建一个简单的RestController，代码如下：

package net.yiim.apidemo.controller;

import org.springframework.web.bind.annotation.*;

import java.util.HashMap;
import java.util.Map;

@RestController
public class TestController {

    @GetMapping(value = "/testGet", produces="application/json;charset=UTF-8")
    @ResponseBody
    public Map<String, Object> testGet(@RequestParam(value = "p", required = false) String p,
                                       @RequestParam(value = "ab", required = false) int ab,
                                       @RequestParam(value = "x", required = false) int x) {
        Map<String, Object> retMap = new HashMap<>();
        retMap.put("code", 0);
        retMap.put("message", "success");
        retMap.put("param1", p);
        retMap.put("param2", ab);
        retMap.put("param3", x);
        return retMap;
    }

    @PostMapping(value = "/testPostFromdata", produces="application/json;charset=UTF-8", consumes = "application/x-www-form-urlencoded;charset=UTF-8")
    @ResponseBody
    public Map<String, Object> testPostFromdata(@RequestParam(value = "p", required = false) String p,
                                                @RequestParam(value = "ab", required = false) int ab,
                                                @RequestParam(value = "x", required = false) int x) {
        Map<String, Object> retMap = new HashMap<>();
        retMap.put("code", 0);
        retMap.put("message", "success");
        retMap.put("param1", p);
        retMap.put("param2", ab);
        retMap.put("param3", x);
        return retMap;
    }

    @PostMapping(value = "/testPostBody", produces="application/json;charset=UTF-8")
    @ResponseBody
    public Map<String, Object> testPostBody(@RequestBody Map<String, Object> body) {
        Map<String, Object> retMap = new HashMap<>();
        retMap.put("code", 0);
        retMap.put("message", "success");
        retMap.put("body", body);
        return retMap;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

接下来我们后续展开的接口安全这块，就有基础素材了。

改一下Spring配置，默认不序列化值为null的字段，application.yml：

# Spring配置
spring:
  jackson:
    # 默认不序列化null
    default-property-inclusion: non_null

1
2
3
4
5

# 接口测试

把项目启动后，我们可以使用Postman或curl来测试一下我们刚刚写的接口

Postman截图比较麻烦，我们用curl来展示请求的内容。

# testGet

ikantech:~ saint$ curl -v 'http://127.0.0.1:8080/testGet?p=testp'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> GET /testGet?p=testp HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.54.0
> Accept: */*
> 
< HTTP/1.1 200 
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Wed, 29 Mar 2023 11:28:02 GMT
< 
* Connection #0 to host 127.0.0.1 left intact
{"code":0,"param":"testp","message":"success"}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# testPostFromdata

这个接口要注意指定它的Content-Type为application/x-www-form-urlencoded，参数用--data-binary指定

ikantech:~ saint$ curl -v -H 'Content-Type: application/x-www-form-urlencoded;charset=UTF-8' --data-binary "p=test1" 'http://127.0.0.1:8080/testPostFromdata'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> POST /testPostFromdata HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.54.0
> Accept: */*
> Content-Type: application/x-www-form-urlencoded;charset=UTF-8
> Content-Length: 7
> 
* upload completely sent off: 7 out of 7 bytes
< HTTP/1.1 200 
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Wed, 29 Mar 2023 11:31:03 GMT
< 
* Connection #0 to host 127.0.0.1 left intact
{"code":0,"param":"test1","message":"success"}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

# testPostBody

同样需要指定Content-Type，curl命令如下：

curl -v -H 'Content-Type: application/json' --data-binary '{
    "pInt": 1,
    "pBoolean": false,
    "pString": "ssss"
}' 'http://127.0.0.1:8080/testPostBody'

1
2
3
4
5

请求及影响内容：

ikantech:~ saint$ curl -v -H 'Content-Type: application/json' --data-binary '{
>     "pInt": 1,
>     "pBoolean": false,
>     "pString": "ssss"
> }' 'http://127.0.0.1:8080/testPostBody'
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> POST /testPostBody HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.54.0
> Accept: */*
> Content-Type: application/json
> Content-Length: 63
> 
* upload completely sent off: 63 out of 63 bytes
< HTTP/1.1 200 
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Wed, 29 Mar 2023 11:34:29 GMT
< 
* Connection #0 to host 127.0.0.1 left intact
{"code":0,"message":"success","body":{"pInt":1,"pBoolean":false,"pString":"ssss"}}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

未经本人同意，禁止转载！

← 概述抓包工具 →