java - 时间戳解析失败

Question

我正在开发一个 Spring-MVC 应用程序，为此我正在开发一个密码重置程序。在其中，我发送了一个手动创建的 token ，其中有 emailid:timestamp:secretkey 加密为 token 。验证token时，验证时间失败，计算时间小于24小时。我正在发布我的代码。请让我知道我做错了什么:

服务类:

@Service
public class PersonServiceImpl implements PersonService {

    private static final String HMAC_ALGO = "HmacSHA256";
    private static final String TOKEN_SEPARATOR = ":";
    private static final long MAX_AGE = 1_000 * 60 * 60 * 24; // 24h
     private static final String signKey = "secretvalue";
 @Override
    public void createToken(String username){
        long timestamp = System.currentTimeMillis();
        StringBuilder sb = new StringBuilder();
        sb.append(generateTokenStringPublicPart(username, timestamp));
        sb.append(TOKEN_SEPARATOR);
        try {
            sb.append(computeSignature(username, timestamp, signKey));
        } catch (InvalidKeyException e) {
            e.printStackTrace();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }
}
 private static String generateTokenStringPublicPart(String username, long timestamp) {
        StringBuilder sb = new StringBuilder();
        sb.append(username);
        sb.append(TOKEN_SEPARATOR);
        sb.append(timestamp);
        return sb.toString();
    }

    private static String computeSignature(String username, long timestamp, String secretKey) throws InvalidKeyException, NoSuchAlgorithmException {
        StringBuilder sb = new StringBuilder();
        sb.append(generateTokenStringPublicPart(username, timestamp));
        SecretKeySpec sks = new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), HMAC_ALGO);
        Mac hmac = Mac.getInstance(HMAC_ALGO);
        hmac.init(sks);
     return Base64.encodeBase64URLSafeString(hmac.doFinal(sb.toString().getBytes(StandardCharsets.UTF_8)));
    }

 public static boolean verifyToken(String token) throws InvalidKeyException, NoSuchAlgorithmException {
        String[] parts = token.split(TOKEN_SEPARATOR);
        boolean result = false;
        if (parts.length == 3) {
            String username = parts[0];
            System.out.println("username in verify token is"+username);
            Long timestamp = Long.valueOf(parts[1]);
            System.out.println("Current timestamp of token is"+timestamp);
            String signature = parts[2];
            if (signature.equals(computeSignature(username, timestamp, signKey))) {
                if (System.currentTimeMillis() - timestamp < MAX_AGE) {  // It fails here
                    result = true;
                }else {
                    System.out.println("Timestamp remaining is"+(System.currentTimeMillis() - timestamp));
                    System.out.println("Time verificaiton failed");
                }
            }
            else {
                System.out.println("Signature is not equal");
            }
        } else{
            System.out.println("Token parts are not 3"+parts.length);
        }

        return result;
    }

控制台输出:

Token value is mymail@gmail.com:1416659092440:MUYLhJS24EIQv5f-Ak7TXyzWKZSjSFKjcmJkJx2SVew
username in verify token is mymail@gmail.com
Current timestamp of token is 1416659092440
Timestamp remaining is 173238774
Time verificaiton failed
Token verification failed

Answer 1

问题在于 Java 中的乘法/除法运算是在加法/减法之前完成的

尝试:

  if ((System.currentTimeMillis() - timestamp) < MAX_AGE) { 

MAX_AGE 的定义也是错误的:

    private static final long MAX_AGE = 1000 * 60 * 60 * 24; // 24h