API接口文档

@PostMapping("/callback")
public String callback(HttpServletRequest request) {
    String appSecret = "应用密钥";

    Map<String, String> paramMap = new HashMap<>();

    //公共参数
    paramMap.put("appKey", request.getParameter("appKey"));
    paramMap.put("timestamp", request.getParameter("timestamp"));
    paramMap.put("nonce", request.getParameter("nonce"));
    paramMap.put("version", request.getParameter("version"));
    paramMap.put("signMethod", request.getParameter("signMethod"));
    paramMap.put("sign", request.getParameter("sign"));

    //具体接口参数
    paramMap.put("code", request.getParameter("code"));

    String state = request.getParameter("state");
    paramMap.put("state", state);
    // 如果state为over，则包含证书信息
    if (StringUtils.equalsIgnoreCase(state, "OVER")) {
        paramMap.put("signatureCert", request.getParameter("signatureCert"));
        paramMap.put("encryptionCert", request.getParameter("encryptionCert"));
        paramMap.put("encryptionPrivateKey", request.getParameter("encryptionPrivateKey"));
        paramMap.put("certId", request.getParameter("certId"));
    }

    String signContent = SignUtils.getSignatureContent(paramMap);
    System.out.println("signContent = " + signContent);

    boolean check = SignUtils.signCheck(paramMap, appSecret, "UTF-8", SignUtils.SIGN_TYPE_HMAC_SHA_256);
    if (!check) {
        System.err.println("验签失败");
        return "fail";
    }
    // todo 业务逻辑

    // 返回通知成功,固定值success
    return "success";
}

   /**
 * 跳转url验签示例
 */
@RequestMapping(value = "/callback", method = {RequestMethod.GET})
public void callback(HttpServletRequest request) {
  Map<String, String> paranMap = Maps.newHashMap();
  //公共参数
  paranMap.put("appKey", request.getParameter("appKey"));
  paranMap.put("state", request.getParameter("state"));
  paranMap.put("nonce", request.getParameter("nonce"));
  paranMap.put("version", request.getParameter("version"));
  paranMap.put("timestamp", request.getParameter("timestamp"));
  paranMap.put("signMethod", request.getParameter("signMethod"));
  paranMap.put("sign", request.getParameter("sign"));

  paranMap.put("code", request.getParameter("code"));
  String appSecret = "应用密钥";

  //验签
  boolean check = SignUtils.signCheck(paramMap, appSecret, "UTF-8", SignUtils.SIGN_TYPE_HMAC_SHA_256);
  if (check) {
    // todo 验签成功,获取结果

  }
}

import org.apache.commons.lang3.StringUtils;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.*;

public class SignUtils {

  public final static String SIGN_TYPE_HMAC_SHA_1 = "HmacSHA1";

  public final static String SIGN_TYPE_HMAC_SHA_256 = "HmacSHA256";

  public final static String REQUEST_PUBLIC_PARAMS_SIGN = "sign";

  public final static String CHARSET = "UTF-8";

  private static final Object LOCK = new Object();

  /**
   * Prototype of the Mac instance.
   */
  private static Mac macInstance;

  /**
   * 验签
   *
   * @param paranMap
   * @param appSecret
   * @param charset
   * @param signType
   * @return
   */
  public static boolean signCheck(Map<String, String> paranMap, String appSecret, String charset, String signType) {
    // 字典排序
    String sign = paranMap.get(REQUEST_PUBLIC_PARAMS_SIGN);
    String content = getSignCheckContentV1(paranMap);

    if (SIGN_TYPE_HMAC_SHA_1.equals(signType)) {
      return sign.equals(computeSignature(appSecret, content, charset, SIGN_TYPE_HMAC_SHA_1));
    } else {
      return sign.equals(computeSignature(appSecret, content, charset, SIGN_TYPE_HMAC_SHA_256));
    }
  }


  public static String getSignCheckContentV1(Map<String, String> params) {
    if (params == null) {
      return null;
    }
    params.remove(REQUEST_PUBLIC_PARAMS_SIGN);
    return getSignatureContent(params);
  }


  public static String getSignatureContent(Map<String, String> paranMap) {
    return getSignContent(getSortedMap(paranMap));
  }

  public static Map<String, String> getSortedMap(Map<String, String> paranMap) {
    Map<String, String> sortedParams = new TreeMap<>();

    paranMap.keySet().stream()
      .sorted()
      .forEach(sortKey -> sortedParams.put(sortKey, paranMap.get(sortKey)));

    return sortedParams;
  }

  /**
   * @param sortedParams
   * @return
   */
  public static String getSignContent(Map<String, String> sortedParams) {
    StringBuffer content = new StringBuffer();
    List<String> keys = new ArrayList<String>(sortedParams.keySet());
    Collections.sort(keys);

    for (int i = 0; i < keys.size(); i++) {
      String key = keys.get(i);
      String value = sortedParams.get(key);
      if (StringUtils.isNotEmpty(key) && StringUtils.isNotEmpty(value)) {
        content.append(key).append(value);
      }
    }
    return content.toString();
  }


  public static String computeSignature(String key, String data, String charset, String algorithm) {
    try {
      byte[] signData = sign(key.getBytes(charset), data.getBytes(charset), algorithm);
      return byte2hex(signData);
    } catch (UnsupportedEncodingException ex) {
      throw new RuntimeException("Unsupported algorithm: " + charset, ex);
    }
  }


  private static byte[] sign(byte[] key, byte[] data, String algorithm) {
    try {
            /* Because Mac.getInstance(String) calls a synchronized method, it could block on
               invoked concurrently, so use prototype pattern to improve perf. */
      if (macInstance == null) {
        synchronized (LOCK) {
          if (macInstance == null) {
            macInstance = Mac.getInstance(algorithm);
          }
        }
      }

      Mac mac = null;
      try {
        mac = (Mac) macInstance.clone();
      } catch (CloneNotSupportedException e) {
        // If it is not clonable, create a new one.
        mac = Mac.getInstance(algorithm);
      }
      mac.init(new SecretKeySpec(key, algorithm));
      return mac.doFinal(data);
    } catch (NoSuchAlgorithmException ex) {
      throw new RuntimeException("Unsupported algorithm: " + algorithm, ex);
    } catch (InvalidKeyException ex) {
      throw new RuntimeException("Invalid key: " + key, ex);
    }
  }


  /**
   * 把字节流转换为十六进制表示方式。
   */
  protected static String byte2hex(byte[] bytes) {
    StringBuilder sign = new StringBuilder();
    for (int i = 0; i < bytes.length; i++) {
      String hex = Integer.toHexString(bytes[i] & 0xFF);
      if (hex.length() == 1) {
        sign.append("0");
      }
      sign.append(hex.toUpperCase());
    }
    return sign.toString();
  }

}