(4)Webapi接收到相应参数，通过header获取到timespan（时间戳），nonce（随机数），signKey（key），signature（签名参数），判断参数是否为空、接口是否在有效时间内、判断token是否有效、判断和请求的signature(签名)是否相同，如果通过，返回正常的结果。如果验证不通过，返回相应的错误提示信息。

OnActionExecuting(System.Web.Http.Controllers.HttpActionContext filterContext) { ResultMsg result = null; string signKey = string.Empty, timespan = string.Empty, nonce = string.Empty, signature = string.Empty; request = filterContext.Request; )) signKey = request.Headers.GetValues().FirstOrDefault(); )) timespan = request.Headers.GetValues().FirstOrDefault(); )) nonce = request.Headers.GetValues().FirstOrDefault(); )) signature = request.Headers.GetValues().FirstOrDefault(); (filterContext.ActionDescriptor.ActionName.ToLower() == ) { if (string.IsNullOrEmpty(signKey) || string.IsNullOrEmpty(timespan) || string.IsNullOrEmpty(nonce)) { result = new ResultMsg((int)ExceptionStatus.ParameterError, EnumExtension.GetEnumText(ExceptionStatus.ParameterError), null); filterContext.Response = HttpResponseExtension.ToJson(result); base.OnActionExecuting(filterContext); return; } else { base.OnActionExecuting(filterContext); return; } } DbLogger.LogWriteMessage(); string signtoken = string.Empty; (string.IsNullOrEmpty(signKey) || string.IsNullOrEmpty(timespan) || string.IsNullOrEmpty(nonce) || string.IsNullOrEmpty(signature)) { result = new ResultMsg((int)ExceptionStatus.ParameterError, EnumExtension.GetEnumText(ExceptionStatus.ParameterError), null); filterContext.Response = HttpResponseExtension.ToJson(result); base.OnActionExecuting(filterContext); return; } DbLogger.LogWriteMessage(); ts1 = 0; double ts2 = (DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0)).TotalMilliseconds; bool timespanValidate = double.TryParse(timespan, out ts1); double ts = ts2 - ts1; bool falg = ts > int.Parse(WebConfig.UrlExpireTime) * 1000; if (!timespanValidate || falg) { result = new ResultMsg((int)ExceptionStatus.URLExpireError, EnumExtension.GetEnumText(ExceptionStatus.URLExpireError), null); filterContext.Response = HttpResponseExtension.ToJson(result); base.OnActionExecuting(filterContext); return; } DbLogger.LogWriteMessage(); //判断token是否有效 Token token = HttpRuntime.Cache.Get(, WebConfig.signKey, signKey)) as Token; if (token == null) { result = new ResultMsg((int)ExceptionStatus.TokenInvalid, EnumExtension.GetEnumText(ExceptionStatus.TokenInvalid), null); filterContext.Response = HttpResponseExtension.ToJson(result); base.OnActionExecuting(filterContext); return; } else signtoken = token.signToken; DbLogger.LogWriteMessage(); string data = string.Empty; method = request.Method.Method.ToUpper(); switch (method) { : Stream stream = HttpContext.Current.Request.InputStream; string responseJson = string.Empty; StreamReader streamReader = new StreamReader(stream); data = streamReader.ReadToEnd(); break; : NameValueCollection form = HttpContext.Current.Request.QueryString; //第一步：取出所有get参数 IDictionary<string, string> parameters = new Dictionary<string, string>(); for (int f = 0; f < form.Count; f++) { string key = form.Keys[f]; parameters.Add(key, form[key]); } // 第二步：把字典按Key的字母顺序排序 IDictionary<string, string> sortedParams = new SortedDictionary<string, string>(parameters); IEnumerator<KeyValuePair<string, string>> dem = sortedParams.GetEnumerator(); // 第三步：把所有参数名和参数值串在一起 StringBuilder query = new StringBuilder(); while (dem.MoveNext()) { string key = dem.Current.Key; string value = dem.Current.Value; if (!string.IsNullOrEmpty(key)) { query.Append(key).Append(value); } } data = query.ToString(); break; default: result = new ResultMsg((int)ExceptionStatus.HttpMehtodError, EnumExtension.GetEnumText(ExceptionStatus.HttpMehtodError), null); filterContext.Response = HttpResponseExtension.ToJson(result); base.OnActionExecuting(filterContext); break; } DbLogger.LogWriteMessage(); valida = ValidateSign.Validate(signKey, timespan, nonce, signtoken, data, signature); if (!valida) { result = new ResultMsg((int)ExceptionStatus.HttpRequestError, EnumExtension.GetEnumText(ExceptionStatus.HttpRequestError), null); filterContext.Response = HttpResponseExtension.ToJson(result); base.OnActionExecuting(filterContext); return; } else base.OnActionExecuting(filterContext); } }

下面我们进行测试：

GET请求：

返回结果：

但我们在浏览器中直接显示或信息被串改时，不合法的请求就会被识别为请求参数已被修改