Merge remote-tracking branch 'origin/master'

“mitao”

2026-02-28 7cbda50f5904e8ef7d63d93d89a47a13b3193e70

 xp-robotaxi-gateway-boot/src/main/java/com/xiaopeng/gateway/filter/SignFilter.java

@@ -73,6 +73,12 @@
        if (StringUtils.matches(url, signProperties.getWhites())) {
            return chain.filter(exchange);
        }

        // 判断是否为multipart请求
        String contentType = request.getHeaders().getFirst("Content-Type");
        boolean isMultipart = contentType != null && contentType.toLowerCase().contains("multipart/");


        //校验签名
        if(signProperties.getEnable()){
            String sign = request.getHeaders().getFirst(TokenConstants.SIGN);
@@ -93,7 +99,12 @@
            }
            //数据缓存保留24小时
            redisService.setCacheObject("sign:nonce:" + nonce, nonce, 24L, TimeUnit.DAYS);
            return authSign(exchange, chain, sign, nonce, timestamp);
            // 对于multipart请求，只校验headers，不读取body
            if(isMultipart){
                return authMultipartSign(exchange, chain, sign, nonce, timestamp);
            } else {
                return authSign(exchange, chain, sign, nonce, timestamp);
            }
        }
        return chain.filter(exchange.mutate().request(mutate.build()).build());
    }
@@ -105,6 +116,22 @@
        return ServletUtils.webFluxResponseWriter(exchange.getResponse(), msg, HttpStatus.BAD_REQUEST);
    }

    /**
     * multipart请求的签名校验（不读取文件流）
     * @return
     */
    private Mono<Void> authMultipartSign(ServerWebExchange exchange, GatewayFilterChain chain, String sign, String nonce, String timestamp){
       // 对于multipart请求，只使用headers信息进行签名验证
       // 构造基于headers的签名字符串
        JSONObject headerParams = new JSONObject();
        headerParams.put("content-type", exchange.getRequest().getHeaders().getFirst("Content-Type"));
        headerParams.put("content-length", exchange.getRequest().getHeaders().getFirst("Content-Length"));
        if(!authSign(headerParams, sign, nonce, timestamp)){
            return unauthorizedResponse(exchange, "请求失败，请稍后重试！");
        }
        // 直接放行，不读取body
        return chain.filter(exchange);
    }

    /**
     * 校验签名