forked from ghaoo/rboot
-
Notifications
You must be signed in to change notification settings - Fork 0
/
http.go
78 lines (63 loc) · 2.04 KB
/
http.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
package rboot
import (
"crypto/hmac"
"crypto/sha256"
"encoding/base64"
"fmt"
"io/ioutil"
"net/http"
"os"
"time"
)
// 超时时间(秒)
var timeout = 60
// 计算消息签名
// 1. 将参数按照 时间\n加密秘钥\n消息内容 排列,获取需要加密的字符串
// 2. 使用 sha256 将上面的字符串加密获取加密后的字符串
// 3. 将 sha256 加密后的字符串使用 base64 编码获取最终的签名值
func signature(datetime, secret, content string) string {
strToSign := fmt.Sprintf("%s\n%s\n%s", datetime, secret, content)
hmac256 := hmac.New(sha256.New, []byte(secret))
hmac256.Write([]byte(strToSign))
data := hmac256.Sum(nil)
return base64.StdEncoding.EncodeToString(data)
}
// VerifySign 验证签名
func (bot *Robot) VerifySign(sign, secret, content, datetime string) error {
dt, err := time.Parse("2006-01-02 15:04:05", datetime)
if err != nil {
return fmt.Errorf("datetime format is error, should 2006-01-02 15:04:05")
}
if time.Now().Sub(dt).Seconds() > float64(timeout) {
return fmt.Errorf("timeout! the request time is long ago, please try again")
}
if sign != signature(datetime, secret, content) {
return fmt.Errorf("signature verification failed")
}
return nil
}
// listenIncoming 用于传入消息,为保证消息的安全性,消息应该进行签名加密
func (bot *Robot) listenIncoming(w http.ResponseWriter, r *http.Request) {
sign := r.Header.Get("sign")
datetime := r.Header.Get("datetime")
content, err := ioutil.ReadAll(r.Body)
if err != nil {
w.WriteHeader(400)
w.Write([]byte("the message read failed, errmsg: " + err.Error()))
return
}
defer r.Body.Close()
secret := os.Getenv("ROBOT_SECRET")
if err = bot.VerifySign(sign, secret, string(content), datetime); err != nil {
w.WriteHeader(403)
w.Write([]byte(err.Error()))
return
}
var msg = NewMessage(string(content), r.Header.Get("to"))
msg.From = r.Header.Get("from")
msg.Sender = r.Header.Get("sender")
msg.Header = Header(r.Header)
bot.inputChan <- msg
w.WriteHeader(200)
w.Write([]byte("发送成功"))
}