【示例】SpringBoot 前后端数据加密和解密

一、前言

（1）基础与环境要求

1. Spring Boot 2.2.6;
2. JDK8+;
3. Vue + axios;

二、后端

（1）加密+解密接口源码

public interface SecretProcess {

	/**
	 *  <p>数据加密</p>
	 * @param data 待加密数据
	 * @return String 加密结果
	 */
	String encrypt(String data) ;
	
	/**
	 *  <p>数据解密</p>
	 * @param data 待解密数据
	 * @return String 解密后的数据
	 */
	String decrypt(String data) ;

	/**
	 *  <p>加密算法格式：算法[/模式/填充]</p>
	 * @return String
	 */
	String getAlgorithm() ;
	
    // 对数据进行16进制转换
	public static class Hex {
		
		private static final char[] HEX = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
				'a', 'b', 'c', 'd', 'e', 'f' };
		
		public static byte[] decode(CharSequence s) {
			int nChars = s.length();
			if (nChars % 2 != 0) {
				throw new IllegalArgumentException("16进制数据错误");
			}
			byte[] result = new byte[nChars / 2];
			for (int i = 0; i < nChars; i += 2) {
				int msb = Character.digit(s.charAt(i), 16);
				int lsb = Character.digit(s.charAt(i + 1), 16);
				if (msb < 0 || lsb < 0) {
					throw new IllegalArgumentException(
						"Detected a Non-hex character at " + (i + 1) + " or " + (i + 2) + " position");
				}
				result[i / 2] = (byte) ((msb << 4) | lsb);
			}
			return result;
		}
		
		public static String encode(byte[] buf) {
			StringBuilder sb = new StringBuilder() ;
			for (int i = 0, leng = buf.length; i < leng; i++) {
				sb.append(HEX[(buf[i] & 0xF0) >>> 4]).append(HEX[buf[i] & 0x0F]) ;
			}
			return sb.toString() ;
		}
		
	}
	
}

（2）实现类

加密+解密接口抽象类

public abstract class AbstractSecretProcess implements SecretProcess {
	
	@Resource
	private SecretProperties props ;
	
	@Override
	public String decrypt(String data) {
		try {
			Cipher cipher = Cipher.getInstance(getAlgorithm()) ;
			cipher.init(Cipher.DECRYPT_MODE, keySpec()) ;
			byte[] decryptBytes = cipher.doFinal(Hex.decode(data)) ;
			return new String(decryptBytes) ;
		} catch (Exception e) {
			throw new RuntimeException(e) ;
		}
	}
	
	@Override
	public String encrypt(String data) {
		try {
			Cipher cipher = Cipher.getInstance(getAlgorithm()) ;
			cipher.init(Cipher.ENCRYPT_MODE, keySpec()) ;
			return Hex.encode(cipher.doFinal(data.getBytes(Charset.forName("UTF-8")))) ;
		} catch (Exception e) {
			throw new RuntimeException(e) ;
		}
	}
	
	/**
	 *  <p>根据密钥生成不同的密钥材料</p>
	 *  <p>目前支持：AES, DES</p>
	 * @param secretKey 密钥
	 * @param algorithm 算法
	 * @return Key
	 */
	public Key getKeySpec(String algorithm) {
		if (algorithm == null || algorithm.trim().length() == 0) {
			return null ;
		}
		String secretKey = props.getKey() ;
		switch (algorithm.toUpperCase()) {
			case "AES":
				return new SecretKeySpec(secretKey.getBytes(), "AES") ;
			case "DES":
				Key key = null ;
				try {
					DESKeySpec desKeySpec = new DESKeySpec(secretKey.getBytes()) ;
					SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance("DES") ;
					key = secretKeyFactory.generateSecret(desKeySpec);
				} catch (Exception e) {
					throw new RuntimeException(e) ;
				}
				return key ;
			default:
				return null ;
		}
	}
	
	/**
	 *  <p>生成密钥材料</p>
	 * @return Key 密钥材料
	 */
	public abstract Key keySpec() ;
	
}

（3）具体加密算法-实现类

public class AESAlgorithm extends AbstractSecretProcess {

	@Override
	public String getAlgorithm() {
		return "AES/ECB/PKCS5Padding";
	}
	
	@Override
	public Key keySpec() {
		return this.getKeySpec("AES") ;
	}

}

（4）加密属性配置类

@Configuration
public class SecretConfig {
	
	@Bean
	@ConditionalOnMissingBean(SecretProcess.class)
	public SecretProcess secretProcess() {
		return new AESAlgorithm() ;
	}
	
	@Component
	@ConfigurationProperties(prefix = "secret")
	public static class SecretProperties {
		
		private Boolean enabled ;
		private String key ;

		public Boolean getEnabled() {
			return enabled;
		}

		public void setEnabled(Boolean enabled) {
			this.enabled = enabled;
		}

		public String getKey() {
			return key;
		}

		public void setKey(String key) {
			this.key = key;
		}
		
	}
	
}

（5）application.yml 配置

secret:
  key: aaaabbbbccccdddd #密钥
  enabled: true #是否开启加解密功能

（6）自定义注解

① 注解类

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Mapping
@Documented
public @interface SIProtection {

}

② 控制类

@ControllerAdvice
@ConditionalOnProperty(name = "secret.enabled", havingValue = "true")
public class DecryptRequestBodyAdvice extends RequestBodyAdviceAdapter {

	@Resource
	private SecretProcess secretProcess ;
	
	@Override
	public boolean supports(MethodParameter methodParameter, Type targetType,
			Class<? extends HttpMessageConverter<?>> converterType) {
		return methodParameter.getMethod().isAnnotationPresent(SIProtection.class) 
				|| methodParameter.getMethod().getDeclaringClass().isAnnotationPresent(SIProtection.class) ;
	}

	@Override
	public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage, MethodParameter parameter, Type targetType,
			Class<? extends HttpMessageConverter<?>> converterType) throws IOException {
		String body = secretProcess.decrypt(inToString(inputMessage.getBody())) ;
		return new HttpInputMessage() {
			@Override
			public HttpHeaders getHeaders() {
				return inputMessage.getHeaders();
			}
			@Override
			public InputStream getBody() throws IOException {
				return new ByteArrayInputStream(body.getBytes()) ;
			}
		} ;
	}
	
	private String inToString(InputStream is) {
		byte[] buf = new byte[10 * 1024] ;
		int leng = -1 ;
		StringBuilder sb = new StringBuilder() ;
		try {
			while ((leng = is.read(buf)) != -1) {
				sb.append(new String(buf, 0, leng)) ;
			}
			return sb.toString() ;
		} catch (IOException e) {
			throw new RuntimeException(e) ;
		}
	}

}

注意：@ConditionalOnProperty(name = "secret.enabled", havingValue = "true")注解，只有开启了加解密功能才会生效。

（7）对响应内容进行加密返回

@ControllerAdvice
@ConditionalOnProperty(name = "secret.enabled", havingValue = "true")
public class EncryptResponseBodyAdvice implements ResponseBodyAdvice<Object>  {

	@Resource
	private SecretProcess secretProcess ;

	@Override
	public boolean supports(MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
		return returnType.getMethod().isAnnotationPresent(SIProtection.class) 
				|| returnType.getMethod().getDeclaringClass().isAnnotationPresent(SIProtection.class) ;
	}

	@Override
	public Object beforeBodyWrite(Object body, MethodParameter returnType, MediaType selectedContentType,
			Class<? extends HttpMessageConverter<?>> selectedConverterType, ServerHttpRequest request,
			ServerHttpResponse response) {
		if (body == null) {
			return body ;
		}
		try {
			String jsonStr = new ObjectMapper().writeValueAsString(body) ;
			return secretProcess.encrypt(jsonStr) ;
		} catch (Exception e) {
			throw new RuntimeException(e) ;
		}
	}
}

（8）测试

// 第一种：对指定方法进行响应数据加密处理
@PostMapping("/save")
@SIProtection  // 这对具体方法进行加解密
public R save(@RequestBody Users users) {
    return R.success(usersService.save(users)) ;
}

// 第二种：对整个controller的所有方法进行响应数据加密处理
@RestController
@RequestMapping("/users")
@SIProtection // 对该Controller中的所有方法进行加解密处理
public class UsersController {
}

三、前端

（1）引入Crypto.js

① 官网：github.com/brix/crypto… ② 教程：www.cnblogs.com/kingwangzhe…

（2）加解密方法

    /**
 * 加密方法
 * @param data 待加密数据
 * @returns {string|*}
 */
encrypt (data) {
    let key = CryptoJS.enc.Utf8.parse(Consts.Secret.key)
    if (typeof data === 'object') {
        data = JSON.stringify(data)
    }
    let plainText = CryptoJS.enc.Utf8.parse(data)
    let secretText = CryptoJS.AES.encrypt(plainText, key, {mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.Pkcs7}).ciphertext.toString()
    return secretText
},
/**
 * 解密数据
 * @param data 待解密数据
 */
decrypt (data) {
    let key = CryptoJS.enc.Utf8.parse(Consts.Secret.key)
    let secretText = CryptoJS.enc.Hex.parse(data)
    let encryptedBase64Str = CryptoJS.enc.Base64.stringify(secretText)
    let result = CryptoJS.AES.decrypt(encryptedBase64Str, key, {mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.Pkcs7}).toString(CryptoJS.enc.Utf8)
    return JSON.parse(result)
}

（3）配置

let Consts = {
  Secret: {
    key: 'aaaabbbbccccdddd', // 必须16位（前后端要一致，密钥）
    urls: ['/users/save']
  }
}
export default Consts

注意：这里的urls表示对那些请求进行拦截出来（加解密），这里也可以配置 "*" 表示对所有的请求出来。axios 请求前和响应后对数据进行加解密出来， 发送前：

// 请求前，加解密
axios.interceptors.request.use((config) => {
    let uri = config.url
    if (uri.includes('?')) {
        uri = uri.substring(0, uri.indexOf('?'))
    }
    if (window.cfg.enableSecret === '1' && config.data && (Consts.Secret.urls.indexOf('*') > -1 || Consts.Secret.urls.indexOf(uri) > -1)) {
        let data = config.data
        let secretText = Utils.Secret.encrypt(data)
        config.data = secretText
    }
    return config
}, (error) => {
    let errorMessage = '请求失败'
    store.dispatch(types.G_SHOW_ALERT, {title: '请求失败', content: errorMessage, showDetail: false, detailContent: String(error)})
    return Promise.reject(error)
})

// 响应后，加解密
axios.interceptors.response.use((response) => {
    let uri = response.config.url
    if (uri.includes('?')) {
        uri = uri.substring(0, uri.indexOf('?'))
    }
    if (window.cfg.enableSecret === '1' && response.data && (Consts.Secret.urls.indexOf('*') > -1 || Consts.Secret.urls.indexOf(uri) > -1)) {
        let data = Utils.Secret.decrypt(response.data)
        if (data) {
            response.data = data
        }
    }
    return response
}, (error) => {
    console.error('test interceptors.response is in, ${error}')
    return Promise.reject(error)
})

注意：这里的 window.cfg.enableSecret 配置是我自己项目中有个配置文件配置是否开启，这个大家可以根据自己的环境来实现。