思路
- 注册app, 平台发放appid、appsecret
- client加密: 业务参数、timestamp、nonce、appsecret排序, 然后加密生成签名参数signature
- client发送: 业务参数、timestamp、nonce、appid、signature
- server解密: 接收到参数后通过appid查找appsecret, 同样算法排序并生成signature, 然后与client传递的signature做比对, 比对合法即返回token
参考
- https://www.kancloud.cn/jeremylin/safety/2190905
- https://www.alibabacloud.com/help/zh/doc-detail/29475.htm
- https://www.volcengine.com/docs/6392/67509
- https://mp.zhls.qq.com/youshu-docs/develop/dev_account/dev_account_access.html
- https://blog.csdn.net/weixin_42109071/article/details/102390232
- https://help.aliyun.com/document_detail/29475.html
- https://www.cnblogs.com/yangyongjie/p/13723388.html
- https://developer.engage-all.com/backend/open-api.html#租户购买-app
- https://xie.infoq.cn/article/60eb3eed81a076774440bcd51
- https://developer.deere.com/content/home/learnmore/app_security.htm
