‘小程序/APP-短信验证码增加非对称校验’

.gitignore

@@ -2,4 +2,5 @@ public/
 .idea/
 .env
 runtime/
-nohup.out
+nohup.out
+*.pem

app/common/middleware/RateLimitMiddleware.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace app\common\middleware;
+
+use think\facade\Cache;
+use think\Response;
+
+class RateLimitMiddleware
+{
+    // 频率限制配置（单位：秒）
+    protected $rules = [
+        'ip' => ['limit' => 10, 'window' => 60],    // 每IP每分钟10次
+        'mobile' => ['limit' => 5, 'window' => 3600] // 每手机号每小时5次
+    ];
+
+    public function handle($request, \Closure $next)
+    {
+        $mobile = $request->param('mobile');
+        $ip = $request->ip();
+
+        // IP频率检查
+        $ipKey = "rate:ip:{$ip}";
+        if (!$this->checkRate($ipKey, $this->rules['ip'])) {
+            return $this->tooManyRequests('IP请求过于频繁');
+        }
+
+        // 手机号频率检查
+        $mobileKey = "rate:mobile:{$mobile}";
+        if (!$this->checkRate($mobileKey, $this->rules['mobile'])) {
+            return $this->tooManyRequests('该手机号请求过于频繁');
+        }
+
+        return $next($request);
+    }
+
+    protected function checkRate(string $key, array $rule): bool
+    {
+        $count = Cache::get($key, 0);
+
+        if ($count >= $rule['limit']) {
+            return false;
+        }
+
+        Cache::inc($key);
+        if ($count === 0) {
+            Cache::expire($key, $rule['window']);
+        }
+
+        return true;
+    }
+
+    protected function tooManyRequests(string $message): Response
+    {
+        return json([
+            'code' => 429,
+            'msg' => $message,
+            'data' => null
+        ])->code(429);
+    }
+}

app/common/middleware/SignatureMiddleware.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace app\common\middleware;
+
+use think\facade\Cache;
+use think\facade\Log;
+use think\Request;
+use think\Response;
+
+class SignatureMiddleware
+{
+    public function handle(Request $request, \Closure $next)
+    {
+        // 获取必要参数
+        $essential = $request->only(['timestamp', 'nonce', 'signature']);
+
+        // 验证必要参数
+        if (count(array_filter($essential)) !== 3) {
+            return $this->errorResponse('参数不完整', 400);
+        }
+
+        // 验证时间戳（5分钟内有效）
+        if (abs(time() - (int)$essential['timestamp']) > 300) {
+            return $this->errorResponse('请求已过期', 400);
+        }
+
+        // 验证nonce唯一性
+        $nonceKey = 'nonce:' . $essential['nonce'];
+        if (Cache::has($nonceKey)) {
+            return $this->errorResponse('重复请求', 400);
+        }
+
+        // 构造签名数据（与前端完全一致）
+        $signData = $request->param();
+        unset($signData['signature']);
+
+        // 按键名排序
+        ksort($signData);
+
+        // 生成签名字符串（与前端相同格式）
+        $signContent = '';
+        foreach ($signData as $key => $value) {
+            $signContent .= "{$key}={$value}&";
+        }
+        $signContent = rtrim($signContent, '&');
+
+        // 记录原始签名内容（用于调试）
+        Log::debug("Sign Content: " . $signContent);
+
+        // 获取公钥
+        $publicKey = openssl_pkey_get_public(
+            file_get_contents(env('RSA_PUBLIC_KEY_PATH'))
+        );
+
+        if (!$publicKey) {
+            Log::error("公钥加载失败");
+            return $this->errorResponse('系统错误', 500);
+        }
+
+        // 计算签名的MD5值（与前端一致）
+        $md5Hash = md5($signContent);
+        Log::debug("MD5 Hash: " . $md5Hash);
+
+        // 解码前端签名（前端使用公钥加密）
+        $signature = base64_decode($essential['signature']);
+
+        // 使用公钥解密签名
+        $decrypted = '';
+        $success = openssl_public_decrypt($signature, $decrypted, $publicKey);
+
+        if (!$success) {
+            Log::error("签名解密失败: " . openssl_error_string());
+            return $this->errorResponse('签名验证失败', 403);
+        }
+
+        Log::debug("解密结果: " . $decrypted);
+
+        // 比较解密后的值与MD5哈希
+        if ($decrypted !== $md5Hash) {
+            Log::error("签名验证失败: 期望 {$md5Hash}, 实际 {$decrypted}");
+            return $this->errorResponse('签名验证失败', 403);
+        }
+
+        // 记录已使用的nonce（5分钟过期）
+        Cache::set($nonceKey, 1, 300);
+
+        return $next($request);
+    }
+
+    private function errorResponse(string $message, int $code): Response
+    {
+        return json([
+            'code' => $code,
+            'msg' => $message,
+            'data' => null
+        ])->code($code);
+    }
+}

app/controller/api/Auth.php

@@ -48,12 +48,14 @@ use think\App;
 use think\db\exception\DataNotFoundException;
 use think\db\exception\DbException;
 use think\db\exception\ModelNotFoundException;
+use think\Env;
 use think\Exception;
 use think\exception\HttpResponseException;
 use think\facade\Cache;
 use think\facade\Db;
 use think\facade\Log;
 use think\Filesystem;
+use think\Response;
 
 /**
  * Class Auth
@@ -1322,6 +1324,41 @@ class Auth extends BaseController
         return $res;
     }
 
+
+    /**
+     * 获取验签公钥
+     * @return Response
+     */
+    public function getPublicKey(): Response
+    {
+        $path = env('RSA_PUBLIC_KEY_PATH');
+
+        if (empty($path)) {
+            return json([
+                'code' => 500,
+                'msg' => '公钥路径未配置',
+                'data' => null
+            ]);
+        }
+
+        if (!file_exists($path)) {
+            return json([
+                'code' => 500,
+                'msg' => '公钥文件不存在: ' . $path,
+                'data' => null
+            ]);
+        }
+
+        $publicKey = file_get_contents($path);
+        return json([
+            'code' => 200,
+            'msg' => 'success',
+            'data' => [
+                'public_key' => $publicKey
+            ]
+        ]);
+    }
+
     public function verify(UserAuthValidate $validate)
     {
         $data = $this->request->params(['phone', 'code', 'key',"type"]);

route/api.php

@@ -6,6 +6,8 @@
  * Copyright (c) http://crmeb.net
  */
 
+use app\common\middleware\RateLimitMiddleware;
+use app\common\middleware\SignatureMiddleware;
 use think\facade\Route;
 Route::miss(function () {
     $DB = DIRECTORY_SEPARATOR;
@@ -969,8 +971,16 @@ Route::group('api/', function () {
     Route::get('auth/wechat', 'api.Auth/auth');
     //小程序授权
     Route::post('auth/mp', 'api.Auth/mpAuth');
+
+    // 获取验签公钥
+    // openssl genrsa -out request_private_key.pem 2048
+    // openssl rsa -in request_private_key.pem -pubout -out request_public_key.pem
+    Route::get('auth/getPublicKey', 'api.Auth/getPublicKey');
+
     //验证码
-    Route::post('auth/verify', 'api.Auth/verify');
+    Route::post('auth/verify', 'api.Auth/verify')
+        ->middleware(SignatureMiddleware::class)
+        ->middleware(RateLimitMiddleware::class);
     //微信配置
     Route::get('wechat/config', 'api.Wechat/jsConfig');
     //图片验证码