Golang 实现静态文件服务器,并添加权限校验

package main

import (
    "github.com/gin-gonic/gin"
    "github.com/gogf/gf/crypto/gmd5"
    "github.com/gogf/gf/util/gutil"
    "github.com/gogf/gf/os/gfile"
    "errors"
    "fmt"
    "github.com/gogf/gf/os/gtime"
)

var salt = "my_salt_2020"

func main() {
    router := gin.Default()

    router.GET("/:file", func(c *gin.Context) {
        fileName := c.Param("file")

        uuids := c.GetString("u")
        timen := c.GetInt64("t")
        ipips := c.GetString("i")
        signs := c.GetString("s")

        // 判空
        if gutil.IsEmpty(uuids) || gutil.IsEmpty(timen) || gutil.IsEmpty(signs) {
            c.AbortWithError(403, errors.New("bad request"))
            return
        }

        // 签名
        str := fmt.Sprintf("%s_%s_%s_%d", salt, uuids, ipips, timen)
        s, _ := gmd5.Encrypt(str)
        if s != signs {
            c.AbortWithError(403, errors.New("bad request, token is invalid"))
            return
        }

        // 时间校验
        if timen+60*30 <= gtime.Now().Timestamp() {
            c.AbortWithError(403, errors.New("bad request, time is expired"))
            return
        }

        // IP 校验
        if c.ClientIP() != ipips {
            c.AbortWithError(403, errors.New("bad request, ip is invalid"))
            return
        }

        if gutil.IsEmpty(fileName) || !gfile.IsFile(fileName) {
            c.AbortWithError(404, errors.New("file is not exists"))
            return
        }

        c.File(fileName)
    })

    router.Run(":8199")
}

发表评论