Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

helper/sign 接口是临时测试用的? #85

Closed
cppfuns opened this issue Aug 4, 2022 · 2 comments
Closed

helper/sign 接口是临时测试用的? #85

cppfuns opened this issue Aug 4, 2022 · 2 comments

Comments

@cppfuns
Copy link

cppfuns commented Aug 4, 2022

http://127.0.0.1:9999/helper/sign
看功能是可以直接让指定账户在线签名,会不会有疏忽的,把服务对外访问,导致这个接口被恶意使用?

@cppfuns
Copy link
Author

cppfuns commented Aug 9, 2022

@xinliangnote

@xinliangnote
Copy link
Owner

咱们不是有 swagger 接口文档嘛,如果接口开启了签名验证,在 swagger 接口文档中请求接口时,会提示 “签名错误”,为了解决这个问题,增加了一个接口用于生成某个请求的签名。

不过后来调试起来太麻烦... 我就调整为测试环境不进行签名验证了。

另外,这个接口是帮助生成签名的,如果是随意生成的签名也是无效的,请求你的程序也无法验证通过,如果有这个顾虑,可以删掉这个路由。

当然如果“有心人”想破解你的签名验证规则,通过其他方式也可以的,在这我就不说了...

就算是签名验证被破解了,那也无妨,因为一些接口咱们还是需要登录验证的。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants