Shulou(Shulou.com)06/01 Report--

Decrypt and verify the message sent to the front end

1. The message sent to the front end is encrypted as a whole, and then the encrypted data is taken as the value of encodeFieldVals; at the same time, the data sent to the back end by the front end includes the overall encrypted aesKey

An example of a front-end request backend:

Http://127.0.0.1:8080/btoa/user/login

{

EncodeFieldVals= encrypts data

AesKey= overall encrypted aesKey

}

2. The backend obtains the values of encodeFieldVals and aesKey, and uses aesKey to decrypt the encodeFieldVals as a whole. After the overall decryption, the data format of encodeFieldVals is in json format.

The decrypted data format is as follows:

{

"deviceId": "a123xwsdfx4554rcffffooc87"

"osVersion": "5.1.10"

"userName": "Wang Wu"

"password": "a123xwsdfx4554rcffffooc87a123xwsdfx4554rcffffooc87"

"phoneNo": "a123xwsdfx4554rcffffooc87a123xwsdfx4554rcffffooc87a123xwsdfx4554rcffffooc87"

"sex": "male"

EncryptFields: "password,phoneNo"

ServerTimestamp: "1200000"

Signtrue: "asfdsafax3134134912341241WQ"

}

3. Check the signature. The decrypted json has a field signtrue, which is the signature of the front end to the data. Sort all the key values passed from the front end to the background, and then put all the keys except key as signtrue and encodeFieldVals in the following format:

FieldName1=fieldValue1&fieldName2=fieldValue2...

Assemble it into a string; compare it with signtrue after signing. If the equality is equal, the signature verification is successful; otherwise, the signature verification fails.

4. Single-field encryption. In the encrypted json data, some sensitive information fields are encrypted. The encrypted fields are specified by encryptFields and separated by commas. Get the values of these fields for single-field decryption.

Flow chart:

Encrypt and sign the message returned to the front end

1. If all encryption is configured, the data returned to the front end is encrypted, and the encrypted data is returned as the value of encodeFieldVals

2. Get the data returned to the front end to encrypt the single field that needs to be encrypted according to the configured field, and return the encrypted data to the front end as the value of encodeFieldVals. At the same time, the returned json contains encryptFields to identify which fields have been encrypted in a single field.

{

"respCode": "000000"

"respMsg": "deal succeeded"

"userId": "afasfa134dfdasf"

"email": "huang@sina.com"

"phoneNo": "13711645814"

"nickName": "overlord"

"accountInfo": {

"accountNo": "A1237897029"

"identityId": "440902198609228090"

NameName: Zhao Liu

"validateDate": "20101010-20221010"

}

Signtrue: "asfdsafax3134134912341241WQ"

EncryptFields: "identityId,nameName"

}

3. Return the encrypted data to the front end

Flow chart:

Share and follow the official account if you like.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.