exchange = exchange.mutate().request(build -> {
            try {
                build.uri(
                        new URI("http://localhost:8080/v1/product?productId=1"))
                        .build();
            } catch (URISyntaxException e) {
                throw new RuntimeException(e);
            }
        }
).build();

公鑰獲?。?客戶端首先通過(guò)一個(gè)特定的接口從服務(wù)器獲取RSA公鑰。

對(duì)稱密鑰加密：
客戶端生成一個(gè)隨機(jī)的對(duì)稱密鑰，然后使用服務(wù)器的RSA公鑰對(duì)這個(gè)對(duì)稱密鑰進(jìn)行加密。

發(fā)送加密的對(duì)稱密鑰：
客戶端將加密后的對(duì)稱密鑰發(fā)送到服務(wù)器。

對(duì)稱密鑰解密：
服務(wù)器使用自己的RSA私鑰解密客戶端發(fā)送的加密對(duì)稱密鑰，從而得到原始的對(duì)稱密鑰。

加密通信：
從現(xiàn)在開(kāi)始，客戶端和服務(wù)器都會(huì)使用這個(gè)對(duì)稱密鑰來(lái)加密和解密他們之間的通信。這包括URL的動(dòng)態(tài)加密、請(qǐng)求和響應(yīng)的加密解密，以及數(shù)字簽名的驗(yàn)證等。

數(shù)字簽名：
為了確保數(shù)據(jù)的完整性和非否認(rèn)性，客戶端和/或服務(wù)器可以使用對(duì)稱密鑰來(lái)生成和驗(yàn)證數(shù)字簽名。
這樣，雙方都可以確信接收到的數(shù)據(jù)沒(méi)有被篡改，并且確實(shí)來(lái)自預(yù)期的發(fā)送方。 

URL動(dòng)態(tài)加密：
使用對(duì)稱密鑰對(duì)URL進(jìn)行動(dòng)態(tài)加密，以保護(hù)URL中的敏感信息，并防止未經(jīng)授權(quán)的訪問(wèn)。
這個(gè)流程確保了客戶端和服務(wù)器之間的通信安全，防止數(shù)據(jù)被截獲或篡改，同時(shí)也提供了一個(gè)有效的機(jī)制來(lái)驗(yàn)證通信雙方的身份。


具體流程如下：
我們首先需要做的第一步是提供一個(gè)接口讓前端客戶端去訪問(wèn)，
并且獲得到我們的公開(kāi)的RSA公鑰，
然后前端拿到這個(gè)RSA公鑰之后加密自己的對(duì)稱密鑰，
然后再一次發(fā)送一個(gè)請(qǐng)求，
這個(gè)請(qǐng)求攜帶的是通過(guò)RSA公鑰加密過(guò)后的對(duì)稱密鑰，
然后服務(wù)端收到這個(gè)對(duì)稱密鑰之后，
通過(guò)RSA私鑰解密可以得到原本的前端發(fā)送的對(duì)稱密鑰。
此時(shí)，之后的URL動(dòng)態(tài)加密所需要使用到的密鑰，
以及之后請(qǐng)求的數(shù)字簽名的加密，
都使用AES的方式，
并且使用這個(gè)解密后的對(duì)稱密鑰進(jìn)行加密解密

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.reactive.function.server.RouterFunction;
import org.springframework.web.reactive.function.server.RouterFunctions;
import org.springframework.web.reactive.function.server.ServerResponse;

import javax.annotation.PostConstruct;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;

/**
 * @author: 公眾號(hào)：碼猿技術(shù)專欄
 * @date: 2023/10/2 15:13
 * SecurityConfig的作用是返回公鑰
 */
@Configuration
publicclass SecurityConfig {
    private KeyPair keyPair;

    @PostConstruct
    public void init() {
        // Generate RSA key pair
        KeyPairGenerator keyGen;
        try {
            keyGen = KeyPairGenerator.getInstance("RSA");
            keyGen.initialize(2048);
            keyPair = keyGen.genKeyPair();
        } catch (NoSuchAlgorithmException e) {
            thrownew RuntimeException("Failed to generate RSA key pair", e);
        }
    }

    /**
     * 提供給前端獲取RSA公鑰
     * @return
     */
    @Bean
    public RouterFunction<ServerResponse> publicKeyEndpoint() {
        return RouterFunctions.route()
                .GET("/public-key", req -> {
                    String publicKey = Base64.getEncoder().encodeToString(keyPair.getPublic().getEncoded());
                    return ServerResponse.ok().bodyValue(publicKey);
                })
                .build();
    }

    public KeyPair getKeyPair() {
        return keyPair;
    }

}

package blossom.star.project.product;

import org.junit.jupiter.api.Test;

import javax.crypto.Cipher;
import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

//@SpringBootTest
class RSA {

    @Test
    void contextLoads() {
    }


    public static void main(String[] args) throws Exception {
        //TODO 2：這里得到的是獲取rsa的公鑰之后，對(duì)對(duì)稱密鑰進(jìn)行加密，之后就是使用這個(gè)對(duì)稱密鑰進(jìn)行
        //數(shù)據(jù)的加解密
        // Replace with your RSA public key
        String publicKeyPEM = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXBSqSyOPb01/uOnhnFN8Hvaz1IQbXnxFzGp9rWBxRAI2p6o67Elr1+SW68JnXx4swq7+z0U+YZSuszsoqwIrn8XF75bpJ+NKLkH7Bpe5A+If78zTihsCoPs+x74FIaJTSiVCzWP9mCaDSVO2bPTwOvqMwQ7xlmTmN9QShCIJ6uBXaggB5aWdpkh/IsIsZXIlzFB5HxA8AYj3u0AyWZO+pNS1fwq2Q7GPwWG7Zl7bCrUjIbG40k/Ef1BjdJBhQakMUq3Zqx+LJP37Tk4FzW47bwD9AiSL4DAXT+sc+Hw1fNspd2qFZBN94h5Pxkxoc9ZBMWB2bFBdRb6zkEg0/2OwwIDAQAB" ;

        // Replace with your symmetric key
        String symmetricKey = "zhangjinbiao6666";

        // Converting PEM to PublicKey
        byte[] decoded = Base64.getDecoder().decode(publicKeyPEM);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(decoded);
        PublicKey publicKey = keyFactory.generatePublic(keySpec);

        // Encrypting symmetric key
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.ENCRYPT_MODE, publicKey);
        byte[] encryptedSymmetricKey = cipher.doFinal(symmetricKey.getBytes());
        String encryptedSymmetricKeyBase64 = Base64.getEncoder().encodeToString(encryptedSymmetricKey);

        // Printing encrypted symmetric key
        System.out.println(encryptedSymmetricKeyBase64);
    }

}

package blossom.star.project.gateway.filter;

import blossom.star.framework.common.constant.HttpStatus;
import blossom.star.project.gateway.config.SecurityConfig;
import blossom.star.project.gateway.util.GatewayUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.http.MediaType;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.stereotype.Component;
import org.springframework.web.reactive.function.BodyInserters;
import org.springframework.web.reactive.function.server.ServerResponse;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

import javax.crypto.Cipher;
import java.nio.charset.StandardCharsets;
import java.util.Base64;


/**
 * @author 公眾號(hào)：碼猿技術(shù)專欄
 * 對(duì)稱密鑰保存過(guò)濾器
 * 當(dāng)前過(guò)濾器首先會(huì)先獲取請(qǐng)求頭中的對(duì)稱密鑰
 * 如果有，那么獲取對(duì)稱密鑰并且保存到Redis中
 */
//@Component
publicclass SymmetricKeyFilter implements GlobalFilter, Ordered {

    @Autowired
    private SecurityConfig securityConfig;

    @Autowired
    private StringRedisTemplate stringRedisTemplate;


    //TODO 3：這里會(huì)把加密好的對(duì)稱密鑰 解密 然后放入到redis中
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String encryptedSymmetricKey = exchange.getRequest().getHeaders().getFirst("X-Encrypted-Symmetric-Key");
        if (encryptedSymmetricKey != null) {
            try {
                Cipher cipher = Cipher.getInstance("RSA");
                cipher.init(Cipher.DECRYPT_MODE, securityConfig.getKeyPair().getPrivate());
                byte[] decryptedKeyBytes = cipher.doFinal(Base64.getDecoder().decode(encryptedSymmetricKey));
                //得到對(duì)稱密鑰
                String symmetricKey = new String(decryptedKeyBytes, StandardCharsets.UTF_8);

                ////在非阻塞上下文中阻塞調(diào)用可能會(huì)導(dǎo)致線程饑餓
                ////TODO 需要優(yōu)化一下這里 來(lái)確保每個(gè)請(qǐng)求可以唯一對(duì)應(yīng)一個(gè)加密密鑰
                //String sessionId = exchange.getSession().block().getId();
                //stringRedisTemplate.opsForValue().set(sessionId, symmetricKey);
                String redisSymmetricKey = "symmetric:key:"+1;
                stringRedisTemplate.opsForValue().set(redisSymmetricKey, symmetricKey);

            } catch (Exception e) {
                e.printStackTrace();
                String responseBody = "there are something wrong occurs when decrypt your key!!!";
                GatewayUtil.responseMessage(exchange,responseBody);

                // 獲取響應(yīng)對(duì)象
                //ServerHttpResponse response = exchange.getResponse();
                ////處理對(duì)稱密鑰出現(xiàn)了問(wèn)題
                //response.setRawStatusCode(HttpStatus.INTERNAL_SERVER_ERROR);
                //response.getHeaders().setContentType(MediaType.TEXT_PLAIN);
                //
                //// 返回你想要的字符串
                //return response.writeWith(
                //        Mono.just(response.bufferFactory().wrap(responseBody.getBytes())));
            }
        }
        return chain.filter(exchange);
    }

    @Override
    public int getOrder() {
        return -300;
    }

}

http://localhost:8080/v1/product/encrypt/8lPoJ5k/aHpfgKlxB5A9eUXqZ4MvgpFqN/SwDBVwDbERjBkQw62kfAmfsDW2Bngm

package blossom.star.project.product;

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

/**
 * @author: 公眾號(hào)：碼猿技術(shù)專欄
 * @date: 2023/10/2 17:32
 * AES類
 */
publicclass AES {
    //1:首先讓前端對(duì)請(qǐng)求路徑傳輸進(jìn)行AES的加密 密鑰已經(jīng)傳遞
    //比如productId=1 ---》wHYOLLkTn00DVrcmuCFzFQ==
    //如果有多個(gè) 就直接 & 的方式進(jìn)行拼接然后AES加密即可
    //2：signature=wHYOLLkTn00DVrcmuCFzFQ==
    //3：然后在對(duì)整個(gè)URL進(jìn)行加密傳輸，傳輸方式為 /encrypt +
    // /5s7/98nWOXAJKujQ7nj66ZhohFdur/pPBzd3Y9kZqeIrZmPvTegG8
    // +OYwY6IMr9dXtK9vmZvJoEEsWZT+LLBCQ==
    //其中 + 后面的就是我們aes加密后的url ，/encrypt用于表示進(jìn)行前端的路由

    public static void main(String[] args) throws Exception {
        //TODO 1：首先設(shè)定一下加密的內(nèi)容 這里直接用java代碼加密
        String plaintext = "productId=1";
        //String plaintext = "productId=1&signature=wHYOLLkTn00DVrcmuCFzFQ==";
        String symmetricKey = "zhangjinbiao6666";  // Ensure this key has 16 bytes

        String encryptedText = encryptUrl(plaintext, symmetricKey);
        System.out.println(encryptedText);
    }

    public static String encryptUrl(String url, String symmetricKey) throws Exception {
        SecretKeySpec keySpec = new SecretKeySpec(symmetricKey.getBytes(StandardCharsets.UTF_8), "AES");
        Cipher cipher = Cipher.getInstance("AES");
        cipher.init(Cipher.ENCRYPT_MODE, keySpec);
        byte[] encryptedBytes = cipher.doFinal(url.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(encryptedBytes);
    }

}

package blossom.star.project.gateway.filter;

import blossom.star.framework.common.constant.HttpStatus;
import blossom.star.project.gateway.util.CryptoHelper;
import blossom.star.project.gateway.util.GatewayUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.cloud.gateway.support.ServerWebExchangeUtils;
import org.springframework.core.Ordered;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Component;
import org.springframework.util.MultiValueMap;
import org.springframework.web.reactive.function.BodyInserters;
import org.springframework.web.reactive.function.server.ServerResponse;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.util.UriComponents;
import org.springframework.web.util.UriComponentsBuilder;
import reactor.core.publisher.Mono;

import java.net.URI;
import java.net.URISyntaxException;

/**
 * @author 公眾號(hào)：碼猿技術(shù)專欄
 * 當(dāng)前類首先會(huì)解析加密后的URL
 * 當(dāng)前類用于解析參數(shù) 如果參數(shù)解密后和signature不一樣則返回
 * 并且會(huì)重新設(shè)定路由路徑
 */
@Component
publicclass CryptoFilter implements GlobalFilter, Ordered {

    @Autowired
    private StringRedisTemplate stringRedisTemplate;

    @Autowired
    private CryptoHelper cryptoHelper;


    //TODO 4：在這里對(duì)加密的URL進(jìn)行解密
    //并且會(huì)得到路徑的參數(shù)
    //然后對(duì)參數(shù)進(jìn)行加密之后和signature比較判斷是否被修改
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        //String sessionId = exchange.getSession().block().getId();
        String redisSymmetricKey = "symmetric:key:" + 1;
        //String symmetricKey = stringRedisTemplate.opsForValue().get(sessionId);
        String symmetricKey = stringRedisTemplate.opsForValue().get(redisSymmetricKey);
        if (symmetricKey == null) {
            return GatewayUtil.responseMessage(exchange, "this session has not symmetricKey!!!");
        }

        try {
            //URL動(dòng)態(tài)加密  數(shù)字簽名 signature
            //如果URL已加密，則解密該URL
            //path:/v1/product/encrypt/WyYSV30Cor8QX/eWGsQ7yPD3EvNRRS0HF845UOb+KAdwHPKZByMa3250J/z2S4at
            //uri:http://localhost:8080/v1/product/encrypt/WyYSV30Cor8QX/eWGsQ7yPD3EvNRRS0HF845UOb+KAdwHPKZByMa3250J/z2S4at
            String encryptedUrl = exchange.getRequest().getURI().toString();
            String path = exchange.getRequest().getURI().getPath();
            String encryptPathParam = path.substring(path.indexOf("/encrypt/") + 9);
            String decryptedPathParam = cryptoHelper.decryptUrl(encryptPathParam, symmetricKey);
            String decryptedUri =
                    encryptedUrl.substring(0, encryptedUrl.indexOf("/encrypt/"))
                            .concat("?").concat(decryptedPathParam);
            //這個(gè)方法直接修改的是exchange里面的request
            exchange = exchange.mutate().request(build -> {
                try {
                    build.uri(new URI(decryptedUri));
                } catch (URISyntaxException e) {
                    thrownew RuntimeException(e);
                }
            }).build();
            //TODO 需要前端這里首先按照前后端約定的加密方式進(jìn)行一次加密
            //然后得到一個(gè)signature，放在請(qǐng)求的末尾
            //然后對(duì)整個(gè)URL進(jìn)行加密請(qǐng)求
            // 解析解密后的URL以獲取解密的查詢參數(shù)
            UriComponents uriComponents = UriComponentsBuilder.fromUriString(decryptedUri).build();
            MultiValueMap<String, String> decryptedQueryParams = uriComponents.getQueryParams();

            // 驗(yàn)證請(qǐng)求參數(shù)的簽名
            String signature = decryptedQueryParams.getFirst("signature");
            if (!cryptoHelper.verifySignature(decryptedQueryParams, signature, symmetricKey)) {

                return GatewayUtil.responseMessage(exchange,
                        "the param has something wrong!!!");
            }

        } catch (Exception e) {
            return GatewayUtil.responseMessage(exchange,
                    "the internal server occurs an error!!!");
        }

        return chain.filter(exchange);
    }


    @Override
    public int getOrder() {
        return -200;
    }
}

package blossom.star.project.gateway.util;

import org.springframework.context.annotation.Configuration;
import org.springframework.util.MultiValueMap;

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.List;
import java.util.Map;


/**
 * @author 公眾號(hào)：碼猿技術(shù)專欄
 * 密碼學(xué)工具包
 */
@Configuration
publicclass CryptoHelper {

    public String decryptUrl(String encryptedUrl, String symmetricKey) throws Exception {
        SecretKeySpec keySpec = new SecretKeySpec(symmetricKey.getBytes(StandardCharsets.UTF_8), "AES");
        Cipher cipher = Cipher.getInstance("AES");
        cipher.init(Cipher.DECRYPT_MODE, keySpec);
        byte[] decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(encryptedUrl));
        returnnew String(decryptedBytes, StandardCharsets.UTF_8);
    }

    //解析路徑參數(shù)并且加密，后判斷是否和signature一樣
    public boolean verifySignature(MultiValueMap<String, String> queryParams, String signature, String symmetricKey) throws Exception {
        StringBuilder sb = new StringBuilder();
        for (Map.Entry<String, List<String>> entry : queryParams.entrySet()) {
            //將簽名本身從要驗(yàn)證的數(shù)據(jù)中排除
            if (!"signature".equals(entry.getKey())) {
                sb.append(entry.getKey()).append("=").append(String.join(",", entry.getValue())).append("&");
            }
        }
        sb.setLength(sb.length()-1);
        String computedSignature = encryptRequestParam(sb.toString(), symmetricKey);
        return computedSignature.equals(signature);
    }


    public static String encryptRequestParam(String requestParam, String symmetricKey) throws Exception {
        SecretKeySpec keySpec = new SecretKeySpec(symmetricKey.getBytes(StandardCharsets.UTF_8), "AES");
        Cipher cipher = Cipher.getInstance("AES");
        cipher.init(Cipher.ENCRYPT_MODE, keySpec);
        byte[] encryptedBytes = cipher.doFinal(requestParam.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(encryptedBytes);
    }
}

http://localhost:8080/v1/product/encrypt/WLB8EDs2LNTsUJpS/aANt0XqZ4MvgpFqN/SwDBVwDbERjBkQw62kfAmfsDW2Bngm