1 Star 4 Fork 0

DHB / openresty_request_encrypt

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

openresty_request_encrypt

作用

  • 时间戳验证(请求时间相距大于x秒,拒绝请求)
  • 参数加密(RSA加密报文)

在openresty/nginx对请求上来的加密字符解密。这种在网关前置验证请求带来的好处是,无需下游服务考虑接口校验问题,统一在网关处理。

image-20200426182030050

使用

前提:

  • 安装openresty(一个基于NGINX的可伸缩的Web平台,强大的web应用服务器)

依赖

clone lua-resty-rsa项目,把/lib/resty/rsa.lua复制到openresty/lualib/resty目录下

本脚本使用RSA加密算法对请求参数加密/解密,所以在使用前先生成RSA秘钥。

  • 使用本项目中的generate_rsa_keys.lua生成,方法如下:
resty generate_rsa_keys.lua
  • 自行生成(脚本默认使用1024位秘钥、 PKCS#8格式)

配置/例子

新建一个nginx配置文件

-- test.conf

location /proxy/ {
	# 对body解密必须有下面这行
	lua_need_request_body on;
	# 配置脚本位置
	rewrite_by_lua_file decrypt.lua;
	# 代理转发到 http://127.0.0.1:8080/
	proxy_pass http://127.0.0.1:8080/;
}

打开decrypt.lua,替换RSA_PRIV_KEY为你生成的RSA私钥

更多配置项

-- 请求参数不合法返回内容
local REQUEST_ERROR = "{\"code\": \"500\", \"msg\": \"request error\"}"
-- 网关出错返回内容
local GATEWAY_ERROR = "{\"code\": \"500\", \"msg\": \"gateway error\"}"
-- 加密数据的参数名
local REQUEST_PARAM_NAME = "_"
-- 时间戳的参数名
local TIMESTAMP_PARAM_NAME = "t";
-- 限制请求
local LIMIT_SECEND = 60
-- 秘钥的长度大小
local KEY_BITS = 1024
-- 数据加密分段大小
local BLOCK_SIZE = KEY_BITS / 8
-- 加密body请求头前缀 后面加真实的Content-Type
local HEADER_PREFIX = "encrypt/"

请求

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIXoCgIan4PtIvoYXgE99cZ2lz
wdptOcC/J1n/waDhzGvsP1hEKfUKIp0KeXuLBuH9WOWJ/NiUI4eJGVfpWQ+cUbXo
CmQYJg3ynzX4uQom/QpKi9MztzmpG1EpO1w7nGizGeAwmTdtaaBSNXu/DYhXDGS4
geLztVdK7efB+kskUQIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAMhegKAhqfg+0i+h
heAT31xnaXPB2m05wL8nWf/BoOHMa+w/WEQp9QoinQp5e4sG4f1Y5Yn82JQjh4kZ
V+lZD5xRtegKZBgmDfKfNfi5Cib9CkqL0zO3OakbUSk7XDucaLMZ4DCZN21poFI1
e78NiFcMZLiB4vO1V0rt58H6SyRRAgMBAAECgYEAkQmPE9qqXS6kGKRT8uqPoSSd
+ZPWF4BZnETQ6cfwO+IsMNt9egHhBRAfGujq260Ews2pgePLphe90SjOMPQtzlCM
pfHW56hd10+65TrERwPLQnTrg9EUMX7+GH7IYvR1La6LUfCtMFHAxk2fu/vBHTx3
426NibBWt4K8J0xHYJ0CQQD9P/EgoitqMn6O6h251mLWEIGecj3TWN6Cp37UE7j/
MTrS1kG0lX9WemqxMXCmMxMpxipxmIuM37y6lFhoKLofAkEAyouMJeVWsjYPjBKP
4tuJRCyXNY+q9Td4gVd5zHdpaexS/ASatC1y2SWiXXaCpMKCkRQ6vaO17SMCxWtJ
MKkzjwJAShPEEomdLWkrv94XZ96f9oHJiHFeSE38eDdKT/qc6Hib/kQR4CLCpqcU
QlR14QebmWKP076NQ13GtMTjv0P6fQJACNX7oC+YD6AyH28z3basD1BOrGR/FcF8
vU++nX/cFmXb3Oiqgw+0geqVYbRo0J03qvKR+XHp3tV3KnuarsfC2wJBAObcNe7c
QMWC4bBTzTBv0cTM00KEaCfFmjmKtcT5HwTLU/ThKHOYk2fIB84NRfZAVKzNMgzr
KTPzCgYSOghVmbc=
-----END PRIVATE KEY-----

请求参数中必须包含当前的时间戳用于验证,默认的参数key是t,参考上文可以修改为其他

query参数加密

原始参数

arg0=123&arg1=456

需要拼接当前时间戳(秒),java(System.currentTimeMillis() / 1000

arg0=123&arg1=456&t=1587898570

原始请求:http://127.0.0.1/proxy/hello?arg0=123&arg1=456&t=1587898570'

使用公钥加密

61fe759c74de978ee666c81aed0dc1ddad6496a4722e9da739f27807e14a566bf0ac89526ec6f3c4692ba30454d69933d69479a57ac7610d894115b0f83f6da3275eb0de11998ef7096c72d6286a35fadbe566d812460eb366cca7c54ae63ceb85576c7f986d231c40901258ca0d02a797127c274a2c25d6cb02aa74a08a9808

**加密后的请求:**http://127.0.0.1/proxy/hello?_=61fe759c74de978ee666c81aed0dc1ddad6496a4722e9da739f27807e14a566bf0ac89526ec6f3c4692ba30454d69933d69479a57ac7610d894115b0f83f6da3275eb0de11998ef7096c72d6286a35fadbe566d812460eb366cca7c54ae63ceb85576c7f986d231c40901258ca0d02a797127c274a2c25d6cb02aa74a08a9808

body加密

原body

{
	"username": "xxx",
	 "pwd": "xx"
}

加密后body

c2e322c381ba8feacda7e911dfd19a15f8d28924f28d2a93c50301c50c0f91516bddcdc468f2ccc668d12132a3a6234d8f20146b2f0d3f6607a59fc6f101425e703315d44f95a62622f79057b789a55096d747b4475dff167426d939aa57a404087428823ee5dd0a030ddfc6aa40b5d8399fd0da3feefe5b8e5d929e024ec8f0

直接替换即可,需要在原来的Content-Type前加encrypt/,如application/json改成encrypt/application/json

解密body,前提需要配置[ lua_need_request_body on ],在OpenResty里请求体数据总是先 被读入内存,但是为了减小内存占用,设定了一个限制:8KB(32位系统)16KB(64位系统), 超过这个值会存放到硬盘上,这个值可以通过 [ client_body_buffer_size ]改变。

通常来说,内存的速度比硬盘快得多,典型的空间换时间的场景,可以在节约前提下,尽量让数据在内存中。

解密body的逻辑只会读取内存中的body,如果读取不到,不会在尝试读取文件来获取body,尽可能的配置 [ client_body_buffer_size ]的值可以容纳请求体

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

简介

openresty 参数加密验证模块 展开 收起
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
1
https://gitee.com/FYMD/openresty_request_encrypt.git
git@gitee.com:FYMD/openresty_request_encrypt.git
FYMD
openresty_request_encrypt
openresty_request_encrypt
master

搜索帮助