关于php的httpd处理请求头里的签名的方法，验证签名，拒绝服务的演示 - 深圳全飞鸿

<?php
$secretKey = "your_secret_key_here";
// 从请求头获取签名、时间戳和随机数
$receivedSignature = $_SERVER['HTTP_X_SIGNATURE'];
$receivedTimestamp = $_SERVER['HTTP_X_TIMESTAMP'];
$receivedNonce = $_SERVER['HTTP_X_NONCE'];
$receivedData = file_get_contents('php://input'); // 获取请求体内容
// 生成本地签名
$generatedSignature = hash_hmac('sha256', $receivedTimestamp . $receivedNonce . $receivedData, $secretKey);
// 验证签名
if ($receivedSignature === $generatedSignature) {
// 签名验证通过
// 可以继续处理请求
echo "Signature verified. Request processing...";
} else {
// 签名验证失败，返回错误响应
http_response_code(401); // 设置响应状态码为 Unauthorized
echo "Signature verification failed. Unauthorized request.";
}
?>

复制代码