手機客戶端與後臺互動中一般會用到加密傳輸。至於不用HTTPS，本文不討論，這裡給出使用springmvc +http協議，手機客戶端加密部分資料值，後臺進行統一解密。實現思路就是使用攔截器，使用裝飾模式，可以直接使用HttpServletRequestWrapper。

springmvc後臺DES3 解密

原文和密文前後均無空格

資料

#1

原文: karl
密文：HM6LxeRjJxc=
UR編碼: HM6LxeRjJxc%3d

#2

原文: del555
密文: HNf8wVhKhsg=
UR編碼: HNf8wVhKhsg%3d

#3

原文：

在MIME格式的電子郵件中，base64可以用來將binary的位元組序列資料編碼成ASCII字元序列構成的文字。使用時，在傳輸編碼方式中指定base64。然後，每次取出6個bit


• 密文：

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d/sk6VmuOd8c8WHspd3kba490j/3+Dez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn+MvkIJTGiwgPcdD8xEMEWgp6/s9gENhWGGnayBfWrSv/36pBNNVhb+HkKXlwPCAazIVbFK4CrohlviiJ3lJv7/qfFlPNPUAVQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w==

密文URL編碼後:

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d%2Fsk6VmuOd8c8WHspd3kba490j
 
%2F3%2BDez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn%2BMvkIJTGiwgPcdD8xEMEWgp6%2Fs9gENhWGGnayBfWrSv%2F36pBNNVhb%2BHkKXlwPCAazIVbFK4CrohlviiJ3lJv7%2FqfFlPNPUAVQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w%3D%3D

或者

• 密文RFC822格式(76個字元一行):

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d/sk6VmuO
d8c8WHspd3kba490j/3
 
+Dez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn+MvkIJTGiwgPcdD8xEM
EWgp6/s9gENhWGGnayBfWrSv/36pBNNVhb+HkKXlwPCAazIVbFK4CrohlviiJ3lJv7/qfFlPNPUA
VQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w==

密文RFC822格式URL編碼後:

eT9O6eHyB27BKL7u4eXE49xoGZZ4aZdQ3ibZ4uKvlD8yLwCeKJi9SYijf142uufEB36d%2fsk6VmuO%0ad8c8WHspd3kba490j%2f3%2bDez03ycGzNssE4MwuNApSdyQ5BDZTLq7fkxwn%2bMvkIJTGiwgPcdD8xEM%0aEWgp6%2fs9gENhWGGnayBfWrSv%2f36pBNNVhb%2bHkKXlwPCAazIVbFK4CrohlviiJ3lJv7%2fqfFlPNPUA%0aVQYAWbGBJ7vA4osfspzMb0abw3uXSROm7KYopKu9KRe9Cgxs7w%3d%3d

測試

使用已以上資料進行測試

springmvc, phone 使用原文， 其他三個使用加密資料

@Controller
public class IndexController {

    @RequestMapping("/")
    @ResponseBody
    Object index(String phone, String name, String password, String desc) {
        System.out.println("-----------------------------------------");
        System.out.println("phone:" + phone);
        System.out.println("name:" + name);
        System.out.println("password:" + password);
        System.out.println("desc:" + desc);
        return "Hello longdai!";
    }
}

POST:

期望結果:

-----------------------------------------
phone:131212345678
name:karl
password:del555
desc:在MIME格式的電子郵件中，base64可以用來將binary的位元組序列資料編碼成ASCII字元序列構成的文字。使用時，在傳輸編碼方式中指定base64。然後，每次取出6個bit

POSTMAN:

結果:

解密攔截器原始碼：

@Configuration
public class DecryptFilter extends OncePerRequestFilter {
    private static Log log = LogFactory.getLog(DecryptFilter.class);

    private static Pattern BASE64_PATTERN = Pattern.compile("^[a-zA-Z0-9\\+/]+[=]{0,2}$");
    private static Pattern BASE64_PATTERN_RFC822 = Pattern.compile("^[a-zA-Z0-9\\+/\n]+[=]{0,2}$");

    public String filter(HttpServletRequest request, String name, String input) {
        String ret = input;
        if (input == null || input.trim().equals("(null)")) {
            return null;
        }
        boolean b1 = input.length()%4==0 && BASE64_PATTERN.matcher(input).matches();
        boolean b2 = input.length() > 77 && input.charAt(76)=='\n' && BASE64_PATTERN_RFC822.matcher(input).matches();
        if ( !b1 && !b2){
            return injectSQLFilter(name, input);//not base64 text
        }
        try {
            ret = Des3.decode(input);
        } catch (Exception e) {
            log.error(request.getRequestURI() + " error decode " + name + "=" + input, e);
        }
        return injectSQLFilter(name, ret);
    }

    public String injectSQLFilter(String name, String text){
        if(text==null){
            return null;
        }
        if(name.matches("password|passwd|loginPassword|dealPassword")){
            return text;
        }
        //TODO 這裡處理SQL注入，直接處理掉注入資料,或者下層攔截器處理
        return text;
    }

    @Override
    protected void doFilterInternal(final HttpServletRequest request,
                                    HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        chain.doFilter(new HttpServletRequestWrapper(request) {

            protected Map<String, String[]> parameters = new HashMap<String, String[]>();
            @Override
            public String getParameter(String name) {
                if (parameters.containsKey(name)){
                    String[] values = parameters.get(name);
                    if (values!=null && values.length>0){
                        return values[0];
                    }
                }
                String value = super.getParameter(name);
                String retValue = filter(this, name, value);
                parameters.put(retValue, new String[]{retValue});
                return retValue;
            }

            @Override
            public String[] getParameterValues(String name) {
                if (parameters.containsKey(name)){
                    String[] values = parameters.get(name);
                    return values;
                }
                String[] values = super.getParameterValues(name);
                if (values == null) {
                    return null;
                }
                for (int i = 0; i < values.length; i++) {
                    values[i] = filter(this, name, values[i]);
                }
                parameters.put(name, values);
                return values;
            }

        }, response);

    }
}