速递易开放平台认证规范

Size: px

Start display at page:

Download "速递易开放平台认证规范"

奴辣田
5 years ago
Views:

1 姜润曾浩 Table of Contents 1. 规范示例相关错误说明语言示例 Java C# python php # 规范速递易开放平台 API 采用标准的 HTTP Authorization 头域进行认证, 该认证信息看起来具有如下形式 : Authorization: SDY SDYPartnerId:Signature 速递易会为每一位注册的开放平台合作伙伴发放唯一的标识符 (SDYParnterId) 和对应的密钥 (SDYPartnerSecret) 合作伙伴需要用它们来对所有的 API 请求进行处理, 以通过速递易平台的访问认证下面是计算以及拼装 Authorization 头域的伪代码 : Authorization = "SDY" + " " + SDYPartnerId + ":" + Signature; Signature = Base64( HMAC-SHA1( SDYPartnerSecret, UTF-8-Encoding- Of( InfoToSign ) ) ); 其中,InfoToSign 是待签名的内容, 采用如下方式拼装 InfoToSign = HTTP-Method + "\n" Content-MD5 + "\n" Content-Type + "\n" 1

2 Date + "\n" HTTP-Request-Path; 注意 :Content-Type 中的 charset 必须使用大写, 即 Type:application/json; charset=utf-8 Content- 字段名说明示例 HTTP-Method 请求的 HTTP 方法 GET / POST / PUT / DELETE Content-MD5 请参考 [RFC-1864] ( tools.ietf.org/ html/rfc1864) Base64(MD5( request-content)) Content-Type 请求的内容类型 application/json;charset=utf-8 Date 请求的日期和时间 Fri, 18 Apr :36: HTTP-Request-Path 请求的路径 /v3/devices/ # 示例 POST /v3/devices/ /resv_orders Content-Type: application/ json;charset=utf-8 Content-MD5: NmRkMTljYzI3MmU4Y2QxNg== Date: Fri, 18 Apr :36: { "sender_mobile": " ", "box_type": "grande", "auto_upgd" : true, "send_name": " 张三 ", "consignee_mobile": " ", "consignee_name": " 李四 ", "notify_url": " InfoToSign 的拼接过程 InfoToSign = "POST" + "\n" "NmRkMTljYzI3MmU4Y2QxNg==" + "\n" "application/json;charset=utf-8" + "\n" "Fri, 18 Apr :36: " + "\n" "/v3/devices/ /resv_orders"; 3.# 相关错误说明 HTTP 错误码说明 412 未包含加密所需的头 401 请求未包含 Authorization 头域, 认证无法进行 2

3 403 签名错误, 或者没有访问系统的权限 420 超过 API 的访问频率限制 421 超过可以预约的箱格数量限制 4.# 语言示例下面使用多种语言来作一个说明, 所有说明都以 /v1/boxstatus 为例 4.1.#Java Auth.java import org.apache.http.client.methods.closeablehttpresponse; import org.apache.http.client.methods.httpget; import org.apache.http.client.utils.uribuilder; import org.apache.http.impl.client.closeablehttpclient; import org.apache.http.impl.client.httpclients; import org.slf4j.logger; import org.slf4j.loggerfactory; import javax.crypto.mac; import javax.crypto.spec.secretkeyspec; import java.io.bufferedreader; import java.io.ioexception; import java.io.inputstreamreader; import java.nio.charset.charset; import java.util.base64; public class Auth { protected static int ID = 0; // 用户 ID protected static final String SECRET = ""; // 分配的秘钥 protected static final String HEADER_MD5 = "ZDQxZDhjZDk4ZjAwYjIwNGU5ODAwOTk4ZWNmODQyN2U="; protected static final String HEADER_CONTENT_TYPE = "application/json; charset=utf-8"; protected static final String HEADER_DATE = "Thu,07 Jul :28:50 GMT"; public static void main(string... args) throws Exception { try (CloseableHttpClient client = HttpClients.createDefault()) { URIBuilder builder = new URIBuilder(" builder.addparameter("device", " "); HttpGet get = new HttpGet(builder.build()); 3

4 StringBuilder infotosignbuilder = new StringBuilder(200); infotosignbuilder.append("get").append("\n"); infotosignbuilder.append(header_md5).append("\n"); infotosignbuilder.append(header_content_type).append("\n"); infotosignbuilder.append(header_date).append("\n"); infotosignbuilder.append("/v1/boxstatus"); SecretKeySpec signingkey = new SecretKeySpec(SECRET.getBytes(Charset.forName("utf-8")), "HmacSHA1"); Mac mac = Mac.getInstance("HmacSHA1"); mac.init(signingkey); byte[] rowhmac = mac.dofinal(infotosignbuilder.tostring().getbytes("utf-8")); String signature = Base64.getEncoder().encodeToString(rowHmac); get.addheader("content-md5", HEADER_MD5); get.addheader("content-type", HEADER_CONTENT_TYPE); get.addheader("date", HEADER_DATE); get.addheader("authorization", "SDY " + ID + ":" + signature); try (CloseableHttpResponse resp = client.execute(get)) { BufferedReader reader = new BufferedReader(new InputStreamReader(resp.getEntity().getContent())); System.out.println("content is :"); String line = reader.readline(); while (line!= null) { System.out.println(line); line = reader.readline(); catch (IOException e) { e.printstacktrace(); 使用 Apache HttpClient 作为网络客户端 4.2.#C# using System; using System.Text; using RestSharp; using System.Security.Cryptography; namespace SudiyiOpen 4

5 { public class Auth { private const int _thirdpartyid = 0; // 用户 ID private const string _encrypt = ""; // 分配的秘钥 private const String HEADER_MD5 = "ZDQxZDhjZDk4ZjAwYjIwNGU5ODAwOTk4ZWNmODQyN2U="; private const String HEADER_CONTENT_TYPE = "application/json; charset=utf-8"; public static void Main(String[] args) { RestClient client = new RestClient(" RestRequest request = new RestRequest("/v1/boxStatus", Method.GET); request.addparameter("device", " "); request.addheader("content-md5", HEADER_MD5); request.addheader("content-type", HEADER_CONTENT_TYPE); string date = DateTime.Now.ToString("r"); request.addheader("date", date); StringBuilder sb = new StringBuilder(200); sb.append(method.get.tostring()).append("\n"); sb.append(header_md5).append("\n"); sb.append(header_content_type).append("\n"); sb.append(date).append("\n"); sb.append("/v1/boxstatus"); Encoding encoding = Encoding.UTF8; byte[] bytekey = encoding.getbytes(_encrypt); HMACSHA1 hmac = new HMACSHA1(); hmac.key = bytekey; byte[] Signature_HMACSHA = hmac.computehash(encoding.getbytes(sb.tostring())); string auth = Convert.ToBase64String(Signature_HMACSHA); request.addheader("authorization", "SDY " + _thirdpartyid + ":" + auth); IRestResponse resp = client.execute(request); Console.Write(resp.Content); Console.ReadKey(); 使用 RestSharp 作为网络客户端 5

6 必须使用 ToString("r"), 其它格式的日期字符串会被.Net 底层重写 4.3.#python auth.py from requests import get import hmac import hashlib import base64 thirdparty_id = 0 # your id thirdparty_secret = '' # your secret def gen_authorization(headers, method, path, secret): tosign = method + '\n' tosign = tosign + headers['content-md5'] + '\n' tosign = tosign + headers['content-type'] + '\n' tosign = tosign + headers['date'] + '\n' tosign = tosign + path tosign = tosign.encode('utf-8') hash1 = hmac.new(secret, tosign, hashlib.sha1).digest() ret = base64.encodestring(hash1) if ret[-1] == "\n": return ret[:-1] else: return ret headers = { 'Content-Type': 'application/json;charset=utf-8', 'Content-MD5': 'ZDQxZDhjZDk4ZjAwYjIwNGU5ODAwOTk4ZWNmODQyN2U=', 'Date': 'Thu,07 Jul :28:50 GMT', 'Accept': 'application/json' headers['authorization'] = "SDY " + str(thirdparty_id) + ':' + \ thirdparty_secret) gen_authorization(headers, 'GET', '/v1/boxstatus', print('get /v1/boxstatus/...') resp = get(' params={"device": , headers=headers) print('response status code: %d' % resp.status_code) 6

7 print('response content: ' + resp.content) 使用 requests 来发送 http 请求 4.4.#php auth.php <?php $partner_id = 0; $partner_key = ''; $now = date('d,d M Y H:i:s',time()).' GMT'; $n = "\n"; $content_type = 'application/json;charset=utf-8'; $content_md5 = base64_encode(md5('')); $info2sign = 'GET'. $n. $content_md5. $n. $content_type. $n. $now. $n. '/v1/ boxstatus'; $authorization = "SDY ".$partner_id.":".base64_encode(hash_hmac("sha1", $info2sign, $partner_key, true)); $header = array( 'Content-Type:'. $content_type, 'Date:'.$now, 'Content-MD5:'. $content_md5, 'Authorization:'. $authorization, ); $ch = curl_init(); curl_setopt($ch, CURLOPT_TIMEOUT, 5); curl_setopt($ch, CURLOPT_HTTPHEADER, $header); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, ' curl_setopt($ch, CURLOPT_HTTPGET, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); $response = curl_exec($ch); if ($response) { curl_close($ch); var_dump($response); else { $info = curl_getinfo($ch); curl_close($ch); 7

8 8

untitled

untitled 1 Outline 數料數數列亂數練數數數來數數來數料利料來數 A-Z a-z _ () 不數 0-9 數不數 SCHOOL School school 數讀 school_name schoolname 易不 C# my name 7_eleven B&Q new C# (1) public protected private params override