API接口的签名验证与防篡改机制

import hmac
import hashlib
import time

def generate_signature(params, secret_key):
    # 排序参数
    sorted_params = sorted(params.items())
    # 拼接参数
    param_string = '&'.join([f"{k}={v}" for k, v in sorted_params])
    # 添加时间戳
    timestamp = str(int(time.time()))
    param_string += f"&timestamp={timestamp}"
    # 生成签名
    signature = hmac.new(secret_key.encode(), param_string.encode(), hashlib.sha256).hexdigest()
    return signature, timestamp

# 示例参数
params = {'action': 'get_user', 'user_id': '12345'}
secret_key = 'your_secret_key_here'

signature, timestamp = generate_signature(params, secret_key)
print(f"Signature: {signature}")
print(f"Timestamp: {timestamp}")

def verify_signature(params, signature, secret_key, timestamp):
    # 检查时间戳是否在有效范围内
    current_time = int(time.time())
    if abs(current_time - int(timestamp)) > 300:  # 5分钟有效期
        return False

    # 重新生成签名
    sorted_params = sorted(params.items())
    param_string = '&'.join([f"{k}={v}" for k, v in sorted_params])
    param_string += f"&timestamp={timestamp}"
    expected_signature = hmac.new(secret_key.encode(), param_string.encode(), hashlib.sha256).hexdigest()

    # 比较签名
    return hmac.compare_digest(signature, expected_signature)

# 示例验证
params = {'action': 'get_user', 'user_id': '12345'}
secret_key = 'your_secret_key_here'
signature = 'your_signature_here'
timestamp = 'your_timestamp_here'

is_valid = verify_signature(params, signature, secret_key, timestamp)
print(f"Signature is valid: {is_valid}")