PHP、Java、C#实现URI参数签名算法，确保应用与REST服务器之间的安全通信，防止Secret Key盗用、数据篡改等恶意攻击行为

[
    "session_key" => "9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A=",
    "timestamp" => "2011-06-21 17:18:09",
    "format" => "json",
    "uid" => 67411167
]

 [
    "session_key=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A=",
    "timestamp=2011-06-21 17:18:09",
    "format=json",
    "uid=67411167"
 ]

 [
    "format=json",
    "session_key=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A=",
    "timestamp=2011-06-21 17:18:09",
    "uid=67411167"
 ]

GET /rest/2.0/passport/users/getInfo?session_key=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A%3D&timestamp=2011-06-21+17%3A18%3A09&format=json&uid=67411167&sign=d24dd357a95a2579c410b3a92495f009 HTTP/1.1
Host: openapi.baidu.com
User-Agent: Client of Baidu Open Platform
Accept: */*
Accept-Encoding: gzip,deflate
Accept-Charset: utf-8
Connection: close

或
POST /rest/2.0/passport/users/getInfo HTTP/1.1
Host: openapi.baidu.com
User-Agent: Client of Baidu Open Platform
Accept: */*
Accept-Encoding: gzip,deflate
Accept-Charset: utf-8
Content-Length: 179
Connection: close
 
session_key=9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A%3D&timestamp=2011-06-21+17%3A18%3A09&format=json&uid=67411167&sign=d24dd357a95a2579c410b3a92495f009

/**
  * 签名生成算法
  * @param  array  $params API调用的请求参数集合的关联数组，不包含sign参数
  * @param  string $secret 签名的密钥即获取access token时返回的session secret
  * @return string 返回参数签名值
  */
 function getSignature($params, $secret)
 {
    $str = ‘‘;  //待签名字符串
    //先将参数以其参数名的字典序升序进行排序
    ksort($params);
    //遍历排序后的参数数组中的每一个key/value对
    foreach ($params as $k => $v) {
        //为key/value对生成一个key=value格式的字符串，并拼接到待签名字符串后面
        $str .= "$k=$v";
    }
    //将签名密钥拼接到签名字符串最后面
    $str .= $secret;
    //通过md5算法为签名字符串生成一个md5签名，该签名就是我们要追加的sign参数值
    return md5($str);
 }

$uid = 67411167;
$params = array(
    "session_key" => "9XNNXe66zOlSassjSKD5gry9BiN61IUEi8IpJmjBwvU07RXP0J3c4GnhZR3GKhMHa1A=",
    "timestamp" => "2011-06-21 17:18:09",
    "format" => "json",
    "uid" => $uid,
);
$sign = getSignature($params, "27e1be4fdcaa83d7f61c489994ff6ed6");

/**
 * 签名生成算法
 * @param HashMap<String,String> params 请求参数集，所有参数必须已转换为字符串类型
 * @param String secret 签名密钥
 * @return 签名
 * @throws IOException
 */
public static String getSignature(HashMap<String,String> params, String secret) throws IOException
{
    // 先将参数以其参数名的字典序升序进行排序
    Map<String, String> sortedParams = new TreeMap<String, String>(params);
    Set<Entry<String, String>> entrys = sortedParams.entrySet();
 
    // 遍历排序后的字典，将所有参数按"key=value"格式拼接在一起
    StringBuilder basestring = new StringBuilder();
    for (Entry<String, String> param : entrys) {
        basestring.append(param.getKey()).append("=").append(param.getValue());
    }
    basestring.append(secret);
 
    // 使用MD5对待签名串求签
    byte[] bytes = null;
    try {
        MessageDigest md5 = MessageDigest.getInstance("MD5");
        bytes = md5.digest(basestring.toString().getBytes("UTF-8"));
    } catch (GeneralSecurityException ex) {
        throw new IOException(ex);
    }
 
    // 将MD5输出的二进制结果转换为小写的十六进制
    StringBuilder sign = new StringBuilder();
    for (int i = 0; i < bytes.length; i++) {
        String hex = Integer.toHexString(bytes[i] & 0xFF);
        if (hex.length() == 1) {
            sign.append("0");
        }
        sign.append(hex);
    }
    return sign.toString();
}

/// <summary>
/// 计算参数签名
/// </summary>
/// <param name="params">请求参数集，所有参数必须已转换为字符串类型</param>
/// <param name="secret">签名密钥</param>
/// <returns>签名</returns>
public static string getSignature(IDictionary<string, string> parameters, string secret)
{
    // 先将参数以其参数名的字典序升序进行排序
    IDictionary<string, string> sortedParams = new SortedDictionary<string, string>(parameters);
    IEnumerator<KeyValuePair<string, string>> iterator= sortedParams.GetEnumerator();
 
    // 遍历排序后的字典，将所有参数按"key=value"格式拼接在一起
    StringBuilder basestring= new StringBuilder();
    while (iterator.MoveNext()) {
            string key = iterator.Current.Key;
            string value = iterator.Current.Value;
            if (!string.IsNullOrEmpty(key) && !string.IsNullOrEmpty(value)){
                basestring.Append(key).Append("=").Append(value);
            }
    }
    basestring.Append(secret);
 
    // 使用MD5对待签名串求签
    MD5 md5 = MD5.Create();
    byte[] bytes = md5.ComputeHash(Encoding.UTF8.GetBytes(basestring.ToString()));
 
    // 将MD5输出的二进制结果转换为小写的十六进制
    StringBuilder result = new StringBuilder();
    for (int i = 0; i < bytes.Length; i++) {
            string hex = bytes[i].ToString("x");
            if (hex.Length == 1) {
                result.Append("0");
            }
            result.Append(hex);
    }
 
    return result.ToString();
}