签名算法

参与签名的参数

签名串格式

signString = HTTP_METHOD + "\n" +
             CONTENT_TYPE + "\n" +
             TIMESTAMP + "\n" +
             NONCE + "\n" +
             REQUEST_URI + "\n" +
             SORTED_QUERY_STRING + "\n" +
             BODY_HASH

签名计算公式

signature = HMAC-SHA256(signString, app_secret)

Python示例

import hmac
import hashlib
import urllib.parse

def generate_signature(method, content_type, timestamp, nonce, uri, params, body, app_secret):
    # 排序参数
    sorted_params = sorted(params.items())
    query_string = urllib.parse.urlencode(sorted_params)
    
    # 计算body hash
    body_hash = hashlib.sha256(body.encode('utf-8')).hexdigest()
    
    # 构造签名串
    sign_string = f"{method}\n{content_type}\n{timestamp}\n{nonce}\n{uri}\n{query_string}\n{body_hash}"
    
    # 计算签名
    signature = hmac.new(
        app_secret.encode('utf-8'),
        sign_string.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    return signature

Java示例

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.*;

public class SignGenerator {
    public static String generateSignature(String method, String contentType, 
                                           String timestamp, String nonce, String uri,
                                           Map params, String body, 
                                           String appSecret) throws Exception {
        // 排序参数
        List keys = new ArrayList<>(params.keySet());
        Collections.sort(keys);
        
        StringBuilder queryString = new StringBuilder();
        for (String key : keys) {
            if (queryString.length() > 0) queryString.append("&");
            queryString.append(key).append("=")
                      .append(URLEncoder.encode(params.get(key), "UTF-8"));
        }
        
        // 计算body hash
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        String bodyHash = bytesToHex(md.digest(body.getBytes(StandardCharsets.UTF_8)));
        
        // 构造签名串
        String signString = String.join("\n", method, contentType, timestamp, 
                                       nonce, uri, queryString.toString(), bodyHash);
        
        // 计算签名
        Mac mac = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(appSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        mac.init(secretKey);
        
        return bytesToHex(mac.doFinal(signString.getBytes(StandardCharsets.UTF_8)));
    }
    
    private static String bytesToHex(byte[] bytes) {
        StringBuilder result = new StringBuilder();
        for (byte b : bytes) {
            result.append(String.format("%02x", b));
        }
        return result.toString();
    }
}

请求头示例

POST /api/v1/user/info HTTP/1.1
Host: api.huaneng.com
Content-Type: application/json
X-App-Key: abc123xyz
X-Timestamp: 1640995200000
X-Nonce: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
X-Signature: 7d8f9e2a1b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1

{
    "user_id": 12345
}

测试步骤

1. 准备测试数据（app_key, app_secret, 请求参数）
2. 使用提供的SDK生成签名
3. 发送测试请求到验证接口
4. 验证签名是否正确

🔐 安全最佳实践

• 密钥保护：app_secret必须保密，不要存储在前端代码中
• HTTPS传输：所有API调用必须使用HTTPS协议
• 定期更新：建议每90天更换一次app_secret
• 访问控制：限制IP白名单，防止密钥泄露
• 监控告警：设置异常调用监控和告警机制
• 日志脱敏：记录日志时避免存储敏感信息

Q&A