完成前端get提交的封装和后端解析

backend/src/main/java/com/jiayue/ssi/controller/UserLoginController.java

@@ -73,7 +73,6 @@ public class UserLoginController {
         String verifyKey = CacheConstants.CAPTCHA_CODE_KEY + uuid;
         // uuid存入缓存，失效时间默认5分钟
         LocalCache.set(verifyKey, captcha.text());
-        System.out.println("uuid:" + uuid);
         // 输出图片流
         // captcha.out(httpServletResponse.getOutputStream());
         String base64 = captcha.toBase64();

backend/src/main/java/com/jiayue/ssi/filter/VerifySmFilter.java

@@ -1,7 +1,9 @@
 package com.jiayue.ssi.filter;
 
+import cn.hutool.json.JSONUtil;
 import com.jiayue.ssi.constant.SecretKeyConstants;
 import com.jiayue.ssi.servlet.ParameterRequestWrapper;
+import com.jiayue.ssi.util.ResponseInfo;
 import com.jiayue.ssi.util.SM2CryptUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.core.annotation.Order;
@@ -27,61 +29,112 @@ public class VerifySmFilter extends OncePerRequestFilter {
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
         // 不是登录操作
-        if (!("POST".equalsIgnoreCase(request.getMethod()) && defaultFilterProcessUrl.equals(request.getServletPath()))) {
-            // 验证token
-            String tokenStr = request.getHeader("Authorization");
-            if (StringUtils.isNotEmpty(tokenStr)){
-                // 解密token
-                String decryptTokenStr = SM2CryptUtils.decrypt(tokenStr,SecretKeyConstants.SERVER_PRIVATE_KEY);
-                System.out.println("接收token后解密："+decryptTokenStr);
-                String tokenSign = request.getHeader("TokenSign");
-                // 验证签名
-                boolean verifySign = SM2CryptUtils.verifySign(SecretKeyConstants.CLIENT_PUBLIC_KEY,decryptTokenStr,tokenSign);
-                if (!verifySign){
+//        if (!("POST".equalsIgnoreCase(request.getMethod()) && defaultFilterProcessUrl.equals(request.getServletPath()))) {
+//            // 验证token
+//            String tokenStr = request.getHeader("Authorization");
+//            if (StringUtils.isNotEmpty(tokenStr)){
+//                // 解密token
+//                String decryptTokenStr = SM2CryptUtils.decrypt(tokenStr,SecretKeyConstants.SERVER_PRIVATE_KEY);
+//                System.out.println("接收token后解密："+decryptTokenStr);
+//                String tokenSign = request.getHeader("TokenSign");
+//                // 验证签名
+//                boolean verifySign = SM2CryptUtils.verifySign(SecretKeyConstants.CLIENT_PUBLIC_KEY,decryptTokenStr,tokenSign);
+//                if (!verifySign){
+//                    // 验签失败
+//                    ResponseInfo.doResponse(response,"token验签失败,不能访问系统！",401);
+//                    return;
+//                }
+//            }
+//            else{
+//                ResponseInfo.doResponse(response,"没有令牌权限,不能访问系统！",401);
+//                return;
+//            }
+//        }
+        // 解密后的参数字符串
+        String decryptStr = "";
+        if ("POST".equalsIgnoreCase(request.getMethod())){
+            // 验证加密的参数文本
+            String data_sm2 = request.getParameter("secretData");
+            if (StringUtils.isNotEmpty(data_sm2)){
+                System.out.println("接收前端加密："+data_sm2);
+                try {
+                    decryptStr = SM2CryptUtils.decrypt(data_sm2, SecretKeyConstants.SERVER_PRIVATE_KEY);
+                }
+                catch (Exception e){
+                    // 参数验签失败
+                    ResponseInfo.doResponse(response,"参数解密失败,不能访问系统！",401);
+                    return;
+                }
+                System.out.println("解密后：" + decryptStr);
+                // 验签前端参数
+                String paramSign = request.getParameter("paramSign");
+                try {
+                    // 验证签名
+                    boolean verifySign = SM2CryptUtils.verifySign(SecretKeyConstants.CLIENT_PUBLIC_KEY, decryptStr, paramSign);
+                    if (!verifySign){
+                        // 验签失败
+                        ResponseInfo.doResponse(response,"参数验签失败,不能访问系统！",401);
+                        return;
+                    }
+                }
+                catch (Exception e){
                     // 验签失败
-                    response.addHeader("Access-Control-Allow-Origin", "*");
-                    response.setContentType("text/html;charset=UTF-8");
-                    response.setStatus(401);
-                    response.getWriter().write("token验签失败,不能访问系统！");
+                    ResponseInfo.doResponse(response,"参数验签失败,不能访问系统！",401);
                     return;
                 }
             }
-            else{
-                response.addHeader("Access-Control-Allow-Origin", "*");
-                response.setContentType("text/html;charset=UTF-8");
-                response.setStatus(401);
-                response.getWriter().write("没有令牌权限,不能访问系统！");
-                return;
-            }
         }
-
-        // 验证加密的参数文本
-        String data_sm2 = request.getParameter("secretData");
-        String decryptStr = "";
-        if (StringUtils.isNotEmpty(data_sm2)){
-            System.out.println("接收前端加密："+data_sm2);
-            decryptStr = SM2CryptUtils.decrypt(data_sm2,SecretKeyConstants.SERVER_PRIVATE_KEY);
-            System.out.println("解密后：" + decryptStr);
-            // 验签前端参数
-            String paramSign = request.getParameter("paramSign");
-            System.out.println(paramSign);
-            // 验证签名
-            boolean verifySign = SM2CryptUtils.verifySign(SecretKeyConstants.CLIENT_PUBLIC_KEY,decryptStr,paramSign);
-            if (!verifySign){
-                // 验签失败
-                response.addHeader("Access-Control-Allow-Origin", "*");
-                response.setContentType("text/html;charset=UTF-8");
-                response.setStatus(401);
-                response.getWriter().write("参数验签失败,不能访问系统！");
-                return;
+        else{
+            // get请求无参数，取出是null
+            String get_sm2Str = request.getParameter("0");
+            if (StringUtils.isNotEmpty(get_sm2Str)){
+                String[] tempStr = get_sm2Str.split("&");
+                Map<String,String> tempMap = new HashMap(16);
+                for (int i=0;i<tempStr.length;i++){
+                    String[] fieldStr = tempStr[i].split("=");
+                    tempMap.put(fieldStr[0],fieldStr[1]);
+                }
+                // 对加密串解密验签
+                System.out.println("接收get请求secretData："+tempMap.get("secretData"));
+                try {
+                    decryptStr = SM2CryptUtils.decrypt(tempMap.get("secretData"), SecretKeyConstants.SERVER_PRIVATE_KEY);
+                }
+                catch (Exception e){
+                    // 参数验签失败
+                    ResponseInfo.doResponse(response,"参数解密失败,不能访问系统！",401);
+                    return;
+                }
+                System.out.println("解密后：" + decryptStr);
+                // 验签前端参数
+                String paramSign = tempMap.get("paramSign");
+                // 验证签名
+                try {
+                    boolean verifySign = SM2CryptUtils.verifySign(SecretKeyConstants.CLIENT_PUBLIC_KEY, decryptStr, paramSign);
+                    if (!verifySign){
+                        // 验签失败
+                        ResponseInfo.doResponse(response,"参数验签失败,不能访问系统！",401);
+                        return;
+                    }
+                }
+                catch (Exception e){
+                    // 验签失败
+                    ResponseInfo.doResponse(response,"参数验签失败,不能访问系统！",401);
+                    return;
+                }
             }
         }
+
         Map<String,Object> stringToMap = new HashMap(16);
         if (!"".equals(decryptStr)){
-            String[] tempInterval = decryptStr.split("&");
-            for (int i=0;i<tempInterval.length;i++){
-                String[] fieldKeyValue = tempInterval[i].split("=");
-                stringToMap.put(fieldKeyValue[0],fieldKeyValue[1]);
+            if ("POST".equalsIgnoreCase(request.getMethod())){
+                String[] tempInterval = decryptStr.split("&");
+                for (int i=0;i<tempInterval.length;i++){
+                    String[] fieldKeyValue = tempInterval[i].split("=");
+                    stringToMap.put(fieldKeyValue[0],fieldKeyValue[1]);
+                }
+            }
+            else{
+                stringToMap = JSONUtil.parseObj(decryptStr).getRaw();
             }
         }
         ParameterRequestWrapper pr = new ParameterRequestWrapper(request, stringToMap);

backend/src/main/java/com/jiayue/ssi/handler/CustomAuthenticationFailureHandler.java

@@ -6,6 +6,8 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import com.jiayue.ssi.constant.CacheConstants;
+import com.jiayue.ssi.util.LocalCache;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
 import org.springframework.stereotype.Component;
@@ -21,12 +23,15 @@ public class CustomAuthenticationFailureHandler extends SimpleUrlAuthenticationF
     @Override
     public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
         AuthenticationException e) throws IOException, ServletException {
+        // 验证码验证
+        String username = request.getParameter("username");
+        // 删除缓存邮箱口令
+        LocalCache.remove(CacheConstants.MAIL_CODE_KEY + username);
         // 清除
         response.addHeader("Access-Control-Allow-Origin", "*");
         response.setContentType("text/html;charset=UTF-8");
         response.setStatus(401);
         response.getWriter().write("用户名或密码错误！");
-        //
     }
 
 }

backend/src/main/java/com/jiayue/ssi/handler/CustomAuthenticationSuccessHandler.java

@@ -6,6 +6,8 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import com.jiayue.ssi.constant.CacheConstants;
+import com.jiayue.ssi.util.LocalCache;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -30,6 +32,11 @@ public class CustomAuthenticationSuccessHandler extends SavedRequestAwareAuthent
 
     @Override
     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
+        // 验证码验证
+        String username = request.getParameter("username");
+        // 删除缓存邮箱口令
+        LocalCache.remove(CacheConstants.MAIL_CODE_KEY + username);
+
         SysUser sysUser = (SysUser) authentication.getPrincipal();
         SecurityContextHolder.getContext().setAuthentication(authentication);
         String token = jwtTokenUtil.generateToken(sysUser);

backend/src/test/java/com/jiayue/ssi/service/Test.java

@@ -52,15 +52,19 @@ public class Test {
 //            st = hex.substring(i, i + 2);
 //            cs[i / 2] = (byte) Integer.parseInt(st, 16);
 //        }
-//        System.out.println(new String(cs,"utf-8"));
-        String content = "SM2签名和验签";
-        final SM2 sm2 = SmUtil.sm2("27ce6eec39dbf3b564a77c4da1e129fe1ba01a92f6d61055a33ed14ffcbc949e","0460ff8c8c306fe62f6f9d11c5c82c30d10bbbc703da094e423072cac7dc663c97fad52eccb34f311f47a07f280de157ba4f2aa659cabe749121384b9376ea2ed2");
-        String sign = sm2.signHex(HexUtil.encodeHexStr(content));
-        System.out.println("sign:" + sign);
-
-        boolean verify = sm2.verifyHex(HexUtil.encodeHexStr(content), sign);
-        System.out.println("校验结果为：" + verify);
+////        System.out.println(new String(cs,"utf-8"));
+//        String content = "SM2签名和验签";
+//        final SM2 sm2 = SmUtil.sm2("27ce6eec39dbf3b564a77c4da1e129fe1ba01a92f6d61055a33ed14ffcbc949e","0460ff8c8c306fe62f6f9d11c5c82c30d10bbbc703da094e423072cac7dc663c97fad52eccb34f311f47a07f280de157ba4f2aa659cabe749121384b9376ea2ed2");
+//        String sign = sm2.signHex(HexUtil.encodeHexStr(content));
+//        System.out.println("sign:" + sign);
+//
+//        boolean verify = sm2.verifyHex(HexUtil.encodeHexStr(content), sign);
+//        System.out.println("校验结果为：" + verify);
 
+        String str = "{\"username\":\"admin\",\"password\":\"1234565\"}";
+        Map<String,Object> map = JSONUtil.parseObj(str).getRaw();
+        System.out.println(map.get("username"));
+        System.out.println(map.get("password"));
 
     }
 }

ui/README.md

@@ -1,91 +1,2 @@
-# vue-admin-template
-
-English | [简体中文](./README-zh.md)
-
-> A minimal vue admin template with Element UI & axios & iconfont & permission control & lint
-
-**Live demo:** http://panjiachen.github.io/vue-admin-template
-
-
-**The current version is `v4.0+` build on `vue-cli`. If you want to use the old version , you can switch branch to [tag/3.11.0](https://github.com/PanJiaChen/vue-admin-template/tree/tag/3.11.0), it does not rely on `vue-cli`**
-
-## Build Setup
-
-
-```bash
-# clone the project
-git clone https://github.com/PanJiaChen/vue-admin-template.git
-
-# enter the project directory
-cd vue-admin-template
-
-# install dependency
-npm install
-
-# develop
-npm run dev
-```
-
-This will automatically open http://localhost:9528
-
-## Build
-
-```bash
-# build for test environment
-npm run build:stage
-
-# build for production environment
-npm run build:prod
-```
-
-## Advanced
-
-```bash
-# preview the release environment effect
-npm run preview
-
-# preview the release environment effect + static resource analysis
-npm run preview -- --report
-
-# code format check
-npm run lint
-
-# code format check and auto fix
-npm run lint -- --fix
-```
-
-Refer to [Documentation](https://panjiachen.github.io/vue-element-admin-site/guide/essentials/deploy.html) for more information
-
-## Demo
-
-![demo](https://github.com/PanJiaChen/PanJiaChen.github.io/blob/master/images/demo.gif)
-
-## Extra
-
-If you want router permission && generate menu by user roles , you can use this branch [permission-control](https://github.com/PanJiaChen/vue-admin-template/tree/permission-control)
-
-For `typescript` version, you can use [vue-typescript-admin-template](https://github.com/Armour/vue-typescript-admin-template) (Credits: [@Armour](https://github.com/Armour))
-
-## Related Project
-
-- [vue-element-admin](https://github.com/PanJiaChen/vue-element-admin)
-
-- [electron-vue-admin](https://github.com/PanJiaChen/electron-vue-admin)
-
-- [vue-typescript-admin-template](https://github.com/Armour/vue-typescript-admin-template)
-
-- [awesome-project](https://github.com/PanJiaChen/vue-element-admin/issues/2312)
-
-## Browsers support
-
-Modern browsers and Internet Explorer 10+.
-
-| [<img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/edge/edge_48x48.png" alt="IE / Edge" width="24px" height="24px" />](http://godban.github.io/browsers-support-badges/)</br>IE / Edge | [<img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/firefox/firefox_48x48.png" alt="Firefox" width="24px" height="24px" />](http://godban.github.io/browsers-support-badges/)</br>Firefox | [<img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/chrome/chrome_48x48.png" alt="Chrome" width="24px" height="24px" />](http://godban.github.io/browsers-support-badges/)</br>Chrome | [<img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/safari/safari_48x48.png" alt="Safari" width="24px" height="24px" />](http://godban.github.io/browsers-support-badges/)</br>Safari |
-| --------- | --------- | --------- | --------- |
-| IE10, IE11, Edge| last 2 versions| last 2 versions| last 2 versions
-
-## License
-
-[MIT](https://github.com/PanJiaChen/vue-admin-template/blob/master/LICENSE) license.
-
-Copyright (c) 2017-present PanJiaChen
+# ssi【State security inspection】
+国密安全检测

ui/src/main.js

@@ -63,19 +63,24 @@ Vue.prototype.$axios.interceptors.request.use(
     config => {
       // get请求映射params参数
       if (config.method === 'get' && config.params) {
-        let url = config.url + '?' + tansParams(config.params);
-        url = url.slice(0, -1);
-        config.params = {};
-        config.url = url;
+        // 参数加密
+        let encryptParam = doEncrypt(JSON.stringify(config.params))
+        // 参数签名
+        let paramSign = doSign(JSON.stringify(config.params))
+        let result = 'secretData='+encryptParam+'&paramSign='+paramSign
+        config.params = result
       }
+
       if (config.method === 'post' || config.method === 'put') {
         if (config.url!='/getMailCode'){
-          // 参数加密
-          let encryptParam = doEncrypt(config.data.toString())
-          // 参数签名
-          let paramSign = doSign(config.data.toString())
-          let result = 'secretData='+encryptParam+'&paramSign='+paramSign
-          config.data = result
+          if (config.data!==undefined){
+            // 参数加密
+            let encryptParam = doEncrypt(config.data.toString())
+            // 参数签名
+            let paramSign = doSign(config.data.toString())
+            let result = 'secretData='+encryptParam+'&paramSign='+paramSign
+            config.data = result
+          }
         }
       }
 

ui/src/views/login/index.vue

@@ -182,13 +182,17 @@ export default {
 
       const param = new URLSearchParams()
       param.append('username', this.loginForm.username)
-      this.$axios.post('/getMailCode', param,
+
+      this.$axios.post(
+        '/getMailCode', param,
       ).then((res) => {
           this.$message.success('邮件发送成功')
       })
     },
     // 获取验证码
     getCaptcha() {
+      // this.$axios.get('/sysFile/getFileContent',{params:{"path":path,"name":name}}).then
+
       this.$axios.get('/getVerifyCode').then((res) => {
         this.verifyuuid = res.data.uuid
         this.captchaUrl = 'data:image/gif;base64,' + res.data.imgBase64;