最近公司有个项目,开发一个微信小程序,里面有个模块是投票。鉴于第一期投票活动被刷票虐的体无完肤,还是得进行总结与进步,尽量的加大刷票难度。
投票的流程中最重要的是验证功能,验证是否符合可以投票的条件。
由小程序调用wx.login触发授权,获取到code值,code再作为请求参数调用后台接口,后台接口根据appid、secret、grant_type和这个code参数调用https://api.weixin.qq.com/sns/jscode2session这个接口获取openid并保存到数据库中,刷票的人无法用正确的code来获取openid,所以安全性相比之前大了许多(o(╥﹏╥)o),获取openid示例如下:
public static JSONObject getMessage(Object code){
Object openid = null;
Object unionid = null;
JSONObject jsonObject = null;
String outputStr = null;
String url1 = "https://api.weixin.qq.com/sns/jscode2session?appid=你的appid&secret=你的secret&js_code=" + code+"&grant_type=authorization_code";
StringBuffer buffer=null;
try{
//创建SSLContext
SSLContext sslContext=SSLContext.getInstance("TLS");
TrustManager[] tm={new MyX509TrustManager()};
//初始化
sslContext.init(null, tm, new java.security.SecureRandom());;
//获取SSLSocketFactory对象
SSLSocketFactory ssf=sslContext.getSocketFactory();
URL url=new URL(url1);
HttpsURLConnection conn=(HttpsURLConnection)url.openConnection();
conn.setDoOutput(true);
conn.setDoInput(true);
conn.setRequestMethod("GET");
//设置当前实例使用的SSLSoctetFactory
conn.setSSLSocketFactory(ssf);
conn.connect();
//往服务器端写内容 也就是发起http请求需要带的参数
if(null!=outputStr){
OutputStream os=conn.getOutputStream();
os.write(outputStr.getBytes("utf-8"));
os.close();
}
//读取服务器端返回的内容
InputStream is=conn.getInputStream();
InputStreamReader isr=new InputStreamReader(is,"utf-8");
BufferedReader br=new BufferedReader(isr);
buffer=new StringBuffer();
String line=null;
while((line=br.readLine())!=null){
buffer.append(line);
}
jsonObject = JSONObject.parseObject(buffer.toString());
System.out.println("debug:openIdUtils.getMessage=" + jsonObject);
openid = jsonObject.get("openid");
unionid = jsonObject.get("unionid");
System.out.print("openid:"+openid);
}catch(Exception e){
e.printStackTrace();
}
return jsonObject;
}
以下是生成验证码的工具类代码:
package com.weixin.utils;
import java.awt.Color;
import java.awt.Font;
import java.awt.Graphics;
import java.awt.Graphics2D;
import java.awt.image.BufferedImage;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.Serializable;
import java.util.Random;
import javax.imageio.ImageIO;
import org.apache.commons.lang3.RandomUtils;
import com.alibaba.druid.util.Base64;
public class ValidateCodeUtil {
private static Validate validate = null; //验证码类,用于最后返回此对象,包含验证码图片base64和真值
private static Random random = new Random(); //随机类,用于生成随机参数
private static String randString = "0123456789abcdefghijkmnpqrtyABCDEFGHIJLMNQRTY";//随机生成字符串的取值范围
private static int width = 80; //图片宽度
private static int height = 34; //图片高度
private static int StringNum = 4; //字符的数量
private static int lineSize = 40; //干扰线数量
//将构造函数私有化 禁止new创建
private ValidateCodeUtil() {
super();
}
/**
* 获取随机字符,并返回字符的String格式
* @param index (指定位置)
* @return
*/
private static String getRandomChar(int index) {
//获取指定位置index的字符,并转换成字符串表示形式
return String.valueOf(randString.charAt(index));
}
/**
* 获取随机指定区间的随机数
* @param min (指定最小数)
* @param max (指定最大数)
* @return
*/
private static int getRandomNum(int min,int max) {
return RandomUtils.nextInt(min, max);
}
/**
* 获得字体
* @return
*/
private static Font getFont() {
return new Font("Fixedsys", Font.CENTER_BASELINE, 25); //名称、样式、磅值
}
/**
* 获得颜色
* @param fc
* @param bc
* @return
*/
private static Color getRandColor(int frontColor, int backColor) {
if(frontColor > 255)
frontColor = 255;
if(backColor > 255)
backColor = 255;
int red = frontColor + random.nextInt(backColor - frontColor - 16);
int green = frontColor + random.nextInt(backColor - frontColor -14);
int blue = frontColor + random.nextInt(backColor - frontColor -18);
return new Color(red, green, blue);
}
/**
* 绘制字符串,返回绘制的字符串
* @param g
* @param randomString
* @param i
* @return
*/
private static String drawString(Graphics g, String randomString, int i) {
Graphics2D g2d = (Graphics2D) g;
g2d.setFont(getFont()); //设置字体
g2d.setColor(new Color(random.nextFloat(), random.nextFloat(), random.nextFloat()));//设置颜色
String randChar = String.valueOf(getRandomChar(random.nextInt(randString.length())));
randomString += randChar; //组装
int rot = getRandomNum(5,10);
g2d.translate(random.nextInt(3), random.nextInt(3));
g2d.rotate(rot * Math.PI / 180);
g2d.drawString(randChar, 13*i, 20);
g2d.rotate(-rot * Math.PI / 180);
return randomString;
}
/**
* 绘制干扰线
* @param g
*/
private static void drawLine(Graphics g) {
//起点(x,y) 偏移量x1、y1
int x = random.nextInt(width);
int y = random.nextInt(height);
int xl = random.nextInt(13);
int yl = random.nextInt(15);
g.setColor(new Color(random.nextFloat(), random.nextFloat(), random.nextFloat()));
g.drawLine(x, y, x + xl, y + yl);
}
/**
*
* @MethodName: getRandomCode
* @Description: 生成Base64图片验证码
* @param key
* @return String 返回base64
*/
public static Validate getRandomCode() {
validate = validate==null?new Validate():validate;
// BufferedImage类是具有缓冲区的Image类,Image类是用于描述图像信息的类
BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR);
Graphics g = image.getGraphics();// 获得BufferedImage对象的Graphics对象
g.fillRect(0, 0, width, height);//填充矩形
g.setFont(new Font("Times New Roman", Font.ROMAN_BASELINE, 18));//设置字体
g.setColor(getRandColor(110, 133));//设置颜色
//绘制干扰线
for(int i = 0; i <= lineSize; i++) {
drawLine(g);
}
//绘制字符
String randomString = "";
for(int i = 1; i <= StringNum; i++) {
randomString = drawString(g, randomString, i);
validate.setValue(randomString);
}
g.dispose();//释放绘图资源
ByteArrayOutputStream bs = null;
try {
bs = new ByteArrayOutputStream();
ImageIO.write(image, "png", bs);//将绘制得图片输出到流
String imgsrc = Base64.byteArrayToBase64(bs.toByteArray());
validate.setBase64Str(imgsrc);
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
bs.close();
} catch (IOException e) {
e.printStackTrace();
}finally{
bs = null;
}
}
return validate;
}
public static class Validate implements Serializable{
private static final long serialVersionUID = 1L;
private String Base64Str; //Base64 值
private String base64Header = "data:image/png;base64,";//base64的头部信息
private String value; //验证码值
public String getBase64Str() {
return Base64Str;
}
public void setBase64Str(String base64Str) {
Base64Str = base64Str;
}
public String getValue() {
return value;
}
public void setValue(String value) {
this.value = value;
}
public String getBase64Header() {
return base64Header;
}
public void setBase64Header(String base64Header) {
this.base64Header = base64Header;
}
}
}
在之前所讲的第一点中,已做了openid的获取和保存,使用的话就是在确认投票的接口中进行判断是否是数据库中的有效openid即可,如果在数据库中查询不到,那么这个请求肯定是刷票的人搞的。