From a07694e4d8d03077c719862b4249a119b0ee39d4 Mon Sep 17 00:00:00 2001
From: xuhy <3313886187@qq.com>
Date: 星期六, 28 二月 2026 21:37:03 +0800
Subject: [PATCH] 网关修改
---
xp-robotaxi-gateway-boot/src/main/java/com/xiaopeng/gateway/filter/SignFilter.java | 29 ++++++++++++++++++++++++++++-
1 files changed, 28 insertions(+), 1 deletions(-)
diff --git a/xp-robotaxi-gateway-boot/src/main/java/com/xiaopeng/gateway/filter/SignFilter.java b/xp-robotaxi-gateway-boot/src/main/java/com/xiaopeng/gateway/filter/SignFilter.java
index c3807e3..37c44eb 100644
--- a/xp-robotaxi-gateway-boot/src/main/java/com/xiaopeng/gateway/filter/SignFilter.java
+++ b/xp-robotaxi-gateway-boot/src/main/java/com/xiaopeng/gateway/filter/SignFilter.java
@@ -73,6 +73,12 @@
if (StringUtils.matches(url, signProperties.getWhites())) {
return chain.filter(exchange);
}
+
+ // 判断是否为multipart请求
+ String contentType = request.getHeaders().getFirst("Content-Type");
+ boolean isMultipart = contentType != null && contentType.toLowerCase().contains("multipart/");
+
+
//校验签名
if(signProperties.getEnable()){
String sign = request.getHeaders().getFirst(TokenConstants.SIGN);
@@ -93,7 +99,12 @@
}
//数据缓存保留24小时
redisService.setCacheObject("sign:nonce:" + nonce, nonce, 24L, TimeUnit.DAYS);
- return authSign(exchange, chain, sign, nonce, timestamp);
+ // 对于multipart请求，只校验headers，不读取body
+ if(isMultipart){
+ return authMultipartSign(exchange, chain, sign, nonce, timestamp);
+ } else {
+ return authSign(exchange, chain, sign, nonce, timestamp);
+ }
}
return chain.filter(exchange.mutate().request(mutate.build()).build());
}
@@ -105,6 +116,22 @@
return ServletUtils.webFluxResponseWriter(exchange.getResponse(), msg, HttpStatus.BAD_REQUEST);
}
+ /**
+ * multipart请求的签名校验（不读取文件流）
+ * @return
+ */
+ private Mono<Void> authMultipartSign(ServerWebExchange exchange, GatewayFilterChain chain, String sign, String nonce, String timestamp){
+ // 对于multipart请求，只使用headers信息进行签名验证
+ // 构造基于headers的签名字符串
+ JSONObject headerParams = new JSONObject();
+ headerParams.put("content-type", exchange.getRequest().getHeaders().getFirst("Content-Type"));
+ headerParams.put("content-length", exchange.getRequest().getHeaders().getFirst("Content-Length"));
+ if(!authSign(headerParams, sign, nonce, timestamp)){
+ return unauthorizedResponse(exchange, "请求失败，请稍后重试！");
+ }
+ // 直接放行，不读取body
+ return chain.filter(exchange);
+ }
/**
* 校验签名
--
Gitblit v1.7.1