[JSP] WebService的用户控制方式与加密算法分类的整理

@Service 
@Transactional 
@WebService(endpointInterface = "com.mycompany.sms.ws.SmsService", targetNamespace = "https://www.mycompany.cn/sms", serviceName = "ServiceInstance") 
public class SmsServiceImpl implements SmsService { 
 
  private SecretKey secretKey; 
 
  @Autowired 
  private SessionManager sessionManager; 
 
  // 将十六进制数字字符串转成字节流【保持16位】 
  private String hexStr = "3243456789123459"; 
 
  public SmsServiceImpl() { 
  byte[] hex = SecurityHelper.hexStrToByte(hexStr); 
  secretKey = new SecretKeySpec(hex, "DES"); 
  } 
 
  @Override 
  public String login(String account, String password) { 
  User user = sessionManager.login(secretKey, account, password); 
  return user.getSessionId(); 
  } 
 
  @Override 
  public void logoff(String sessionId) { 
  sessionManager.logoff(sessionId); 
  } 
 
  @Override 
  public boolean sendMessage(String sessionId, String msgNumber, 
    String msgContent) { 
  sessionManager.getUser(secretKey, sessionId); 
  do something...; 
  return true; 
  } 
}

@Component 
public class SessionManager { 
 
  @Autowired 
  private CacheProvider cacheProvider; 
 
  public User login(SecretKey secretKey, String account, String password) { 
  SecurityHelper securityHelper = new SecurityHelper(secretKey); 
  String password2; 
  try { 
    password2 = SecurityHelper.byteToHexStr(securityHelper 
      .encode(account.getBytes("UTF-8"))); 
  } catch (UnsupportedEncodingException e) { 
    throw new LoginException(e); 
  } 
  if (password2.equals(password)) { 
    User user = new User(account); 
    user.setSecretKey(secretKey.getEncoded()); 
    addSession(user); 
    return user; 
  } else { 
    throw new LoginException("登录失败"); 
  } 
  } 
 
  public void logoff(String sessionId) { 
  removeSession(sessionId); 
  } 
 
  private void addSession(User user) { 
  cacheProvider.put("webservice-session-" + user.getSessionId(), user); 
  } 
 
  private void removeSession(String sessionId) { 
  cacheProvider.remove("webservice-session-" + sessionId); 
  } 
 
  public User getUser(SecretKey secretKey, String sessionId) { 
  User user = (User) cacheProvider.get("webservice-session-" + sessionId); 
  if (user == null) { 
    throw new WsException("用户未登录或登录超时"); 
  } else if (!bytesEquals(secretKey.getEncoded(), user.getSecretKey())) { 
    throw new WsException("没有调用本接口的权限"); 
  } else { 
    return user; 
  } 
  } 
 
  private boolean bytesEquals(byte[] bytes1, byte[] bytes2) { 
  for (int i = 0; i < bytes1.length; i++) { 
    if (bytes1[i] != bytes2[i]) { 
    return false; 
    } 
  } 
  return true; 
  } 
 
}