阿里云短信api接入指南

    5.2、安全性保证

        ① 手机号正确性验证：如果手机号本身就是错误的就没必要进行下一步操作

        ② 签名校验：加入AK和SK，防止接口被盗刷

        ③ 1min检测：一个手机号在1min内不允许重复请求

        ④ 手机号操作上限：定义手机号单量操作次数上线（具体根据实际业务情况而定）

        ⑤ ip操作上限：定义单个ip单量操作次数上线（具体根据实际业务情况而定）

        ⑥ 阿里云风控：借助阿里云短信服务风控，配置接口单日总量及单个手机号发送量预警

        ⑦ 前端部分的验证这里少量的提到（发送验证码置灰、多次操作后需要验证码等）

六、核心代码  

    6.1、引入阿里云sdk

        <dependency>
            <groupId>com.aliyun</groupId>
            <artifactId>aliyun-java-sdk-core</artifactId>
            <version>4.5.16</version>
        </dependency>

    6.2、sms工具类

/**
* @author XA
* date 2021/7/12 10:40
 * description: 手机短信业务工具类
*/
@Component
public class SmsUtil {

    @Value("${sms.verify.regionId}")
    private String regionId;

    @Value("${sms.verify.accessKeyId}")
    private String accessKeyId;

    @Value("${sms.verify.secret}")
    private String secret;

    @Value("${sms.verify.signName}")
    private String signName;

    @Value("${sms.verify.templateCode}")
    private String templateCode;

    @Value("${sms.sendTimes}")
    private int sendTimes;

    private SmsUtil (){};

    private static final Logger logger = LoggerFactory.getLogger(SmsUtil.class);

    @Autowired
    private RedisUtil redisUtil;


    public R sendMsg(SmsVO smsVO){
        logger.debug("手机短信接口发送调用：" + smsVO.toString());
        String phone = smsVO.getPhone();

        /* 短信发送前置验证 */
        R verifyRlt = bhVerify(smsVO);
        if(1 != (int)verifyRlt.get("code")){
            return verifyRlt;
        }

        /* 短信Code生成 */
        String code = buildCode(smsVO);
        if("".equals(code)){
            return R.error("验证码生成失败！");
        }

        R sendSmsRlt = sendSms(phone, code);
        if(1 != (int)sendSmsRlt.get("code")){
            return sendSmsRlt;
        }

        /* 短信发送后业务处理 */
        smsBuiness(code, phone, smsVO.getIp());
        return R.error("短信消息发送成功！");
    }

    /**
     * 功能描述: 请求信息验证
     * Param: [smsVO]
     * Return: com.bh.commons.model.param.R
     */
    private R bhVerify(SmsVO smsVO){
        /* 手机号合法性验证 */
        String phone = smsVO.getPhone();
        if(!CommonUtil.isMobileNO(phone)){
            return R.error("手机号不合法！");
        }
        /* todo 签名校验 */
        /* 是否在1min之内已经发送了验证码 */
        String oneMinKey = "sms:" + phone + ":oneMin";
        Object oneMinObj = redisUtil.get(oneMinKey);
        if(oneMinObj != null){
            return R.error("验证码已经发送，请勿重复操作!");
        }
        /* 当前手机号是否已经发送了20次（一天）*/
        String phoneKey = "sms:" + phone + ":sendTimes";
        Object phoneSendTimesObj = redisUtil.get(phoneKey);
        if(null != phoneSendTimesObj){
            int phoneSendTimes = Integer.parseInt(phoneSendTimesObj.toString());
            if(phoneSendTimes > sendTimes){
                return R.error("操作过于频繁，请稍后再试！");
            }
        }
        /* 当前ip是否已经发送了20次（一天）*/
        String ipKey = "sms:" + smsVO.getIp() + ":sendTimes";
        Object ipSendTimesObj = redisUtil.get(ipKey);
        if(null != ipSendTimesObj){
            int ipSendTimes = (int) ipSendTimesObj;
            if(ipSendTimes > sendTimes){
                return R.error("操作过于频繁，请稍后再试！");
            }
        }
        return R.ok();
    }

    /**
     * 功能描述: 验证码生成
     * Param: [smsVO]
     * Return: java.lang.String
     */
    private String buildCode(SmsVO smsVO){
        for(int i=0;i<20;i++){
            long code = Math.round((Math.random() + 1) * 1000);
            String codeKey = "sms:codePool" + code;
            Object codeObj = redisUtil.get(codeKey);
            if(null == codeObj){
                return String.valueOf(code);
            }
        }
        return "";
    }

    private R sendSms(String phone, String code){
        DefaultProfile profile = DefaultProfile.getProfile(regionId, accessKeyId, secret);
        IAcsClient client = new DefaultAcsClient(profile);
        CommonRequest request = new CommonRequest();
        request.setSysMethod(MethodType.POST);
        request.setSysDomain("dysmsapi.aliyuncs.com");
        request.setSysVersion("2017-05-25");
        request.setSysAction("SendSms");
        request.putQueryParameter("PhoneNumbers", phone);
        request.putQueryParameter("SignName", signName);
        request.putQueryParameter("TemplateCode", templateCode);
        request.putQueryParameter("TemplateParam", "{\"bhMsgCode\":" + code + "}");
        try {
            /* {"RequestId":"9823C61C-16B4-4F54-895A-63A3A4ADE3E4","Message":"OK","BizId":"767206326058387972^0","Code":"OK"} */
            CommonResponse response = client.getCommonResponse(request);
            String respData = response.getData();
            logger.debug("手机短信发送结果：" + respData);
            JSONObject respObj = JSONObject.parseObject(respData);
            String respCode = respObj.getString("Code");
            if("OK".equals(respCode)){
                return R.ok();
            }
            String errMsg = respObj.getString("Message");
            logger.error("手机短信验证码发送失败：" + errMsg);
        } catch (Exception e) {
            logger.error("手机短信验证码发送异常：" + e.getMessage());
            e.printStackTrace();
        }
        return R.error();
    }

    /**
     * 功能描述: 验证码发送成功后业务处理
     * Param: [code, phone, ip]
     * Return: void
     */
    private void smsBuiness(String code, String phone, String ip){
        /* 写入codePool（过期时间1min）*/
        String codePoolKey = "sms:codePool:" + code;
        redisUtil.set(codePoolKey, code, 60 * 10);

        /* 写入一分钟内有效数据 */
        String oneMinKey = "sms:" + phone + ":oneMin";
        redisUtil.set(oneMinKey, code, 60);

        /* 手机号（过期时间1d）*/
        String phoneKey = "sms:" + phone + ":sendTimes";
        redisUtil.incr(phoneKey,1);

        /* ip发送记录（过期时间1d）*/
        String ipKey = "sms:" + ip + ":sendTimes";
        redisUtil.incr(ipKey,1);
    }

}