how to confirm which shell you're using

博客展示了shell中echo $0的内容,体现了shell脚本相关操作。
echo $0
Authentication Endpoint security type API requests are likely to be tampered during transmission through the internet. To ensure that the request remains unchanged, all private interfaces other than public interfaces (basic information, market data) must be verified by signature authentication via API-KEY to make sure the parameters or configurations are unchanged during transmission. Each created API-KEY need to be assigned with appropriate permissions in order to access the corresponding interface. Before using the interface, users is required to check the permission type for each interface and confirm there is appropriate permissions. Authentication Type Description NONE Endpoints are freely accessible TRADE Endpoints requires sending a valid API-KEY and signature USER_DATA Endpoints requires sending a valid API-KEY and signature USER_STREAM The endpoints requires sending a valid API-KEY MARKET_DATA The endpoints requires sending a valid API-KEY Signature Authentication Signature (TRADE & USER_DATA) The SIGNED (signature required) endpoint needs to send a parameter, signature, in the query string or request body. The endpoint is signed with HMAC SHA256. The HMAC SHA256 signature is the result of HMAC SHA256 encryption of the key. Use your secretKey as the key and totalParams as the value to complete this encryption process. Signature is not case sensitive. totalParams refers to concatenation of the query string and the request body. All HTTP requests to API endpoints require authentication and authorization. The following headers should be added to all HTTP requests: Key Value Type Description X-HK-APIKEY API-KEY string The API Access Key you applied for Time-base security requirement For a SIGNED endpoint, an additional parameter "timestamp" needs to be included in the request. This timestamp is in milliseconds and reflect the time when the request was initiated. An optional parameter (not mandatory) recvWindow can be used to specify the validity period of the request in milliseconds. If recvWindow is not sent as part of the request, the default value is 5000 📘 If your timestamp is ahead of serverTime it needs to be within 1 second + serverTime The logic of this parameter is as follows: Java if (timestamp < (serverTime + 1000) && (serverTime - timestamp) <= recvWindow) { // process request } else { // reject request } Trading and timeliness are closely interconnected. Network can sometimes be unstable or unreliable, which can lead to inconsistent times when requests are sent to the server. With recvWindow, you can specify how many milliseconds the request is valid, otherwise it will be rejected by the server. 📘 A relatively small recvWindow (5000 or less) is recommended! Example 1: In queryString queryString: symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000 HMAC SHA256 signature: echo -n "symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000" | openssl dgst -sha256 -hmac "lH3ELTNiFxCQTmi9pPcWWikhsjO04Yoqw3euoHUuOLC3GYBW64ZqzQsiOEHXQS76" Shell standard output: 5f2750ad7589d1d40757a55342e621a44037dad23b5128cc70e18ec1d1c3f4c6 curl command: Shell curl -H "X-HK-APIKEY: tAQfOrPIZAhym0qHISRt8EFvxPemdBm5j5WMlkm3Ke9aFp0EGWC2CGM8GHV4kCYW" -X POST 'https://$HOST/api/v1/spot/order?symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000&signature=5f2750ad7589d1d40757a55342e621a44037dad23b5128cc70e18ec1d1c3f4c6' Example 2: In the request body requestBody: symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000 HMAC SHA256 signature: Shell echo -n "symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000" | openssl dgst -sha256 -hmac "lH3ELTNiFxCQTmi9pPcWWikhsjO04Yoqw3euoHUuOLC3GYBW64ZqzQsiOEHXQS76" Shell standard output: 5f2750ad7589d1d40757a55342e621a44037dad23b5128cc70e18ec1d1c3f4c6 curl command: Shell curl -H "X-HK-APIKEY: tAQfOrPIZAhym0qHISRt8EFvxPemdBm5j5WMlkm3Ke9aFp0EGWC2CGM8GHV4kCYW" -X POST 'https://$HOST/api/v1/spot/order' -d 'symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000&signature=5f2750ad7589d1d40757a55342e621a44037dad23b5128cc70e18ec1d1c3f4c6' Example 3: mixing queryString and request body queryString: symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC requestBody: quantity=1&price=0.1&recvWindow=5000×tamp=1538323200000 HMAC SHA256 signature: Shell echo -n "symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTCquantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000" | openssl dgst -sha256 -hmac "lH3ELTNiFxCQTmi9pPcWWikhsjO04Yoqw3euoHUuOLC3GYBW64ZqzQsiOEHXQS76" Shell standard output: 885c9e3dd89ccd13408b25e6d54c2330703759d7494bea6dd5a3d1fd16ba3afa curl command: Shell curl -H "X-HK-APIKEY: tAQfOrPIZAhym0qHISRt8EFvxPemdBm5j5WMlkm3Ke9aFp0EGWC2CGM8GHV4kCYW" -X POST 'https://$HOST/openapi/v1/order?symbol=ETHBTC&side=BUY&type=LIMIT&timeInForce=GTC' -d 'quantity=1&price=0.1&recvWindow=5000&timestamp=1538323200000&signature=885c9e3dd89ccd13408b25e6d54c2330703759d7494bea6dd5a3d1fd16ba3afa' Note the difference in Example 3, where there is no & between "GTC" and "quantity = 1". 根据以上描述生成Python的authentication
最新发布
07-23
在实现基于 HMAC-SHA256 的 API 签名认证机制时,通常需要包含 API-KEY、时间戳(timestamp)、接收窗口(recvWindow)以及签名(signature)等参数,以确保请求的安全性和时效性。以下是一个完整的 Python 实现示例,涵盖签名生成、时间戳处理和 HTTP 请求的安全验证。 ### 签名生成与请求构造 签名的核心是 HMAC-SHA256 算法,它结合时间戳、请求路径、请求体等信息生成唯一签名,用于验证请求来源的合法性。生成签名的原始字符串通常由多个字段拼接而成,包括时间戳、HTTP 方法、请求路径、API-KEY、请求参数等。 ```python import hmac import hashlib import time import requests import random # 配置 API 认证信息 api_key = "your_api_key" secret_key = "your_secret_key" recv_window = 5000 # 接收窗口时间,单位为毫秒 # 请求参数 method = "POST" path = "/api/v1/secure-endpoint" base_url = "https://api.example.com" params = { "amount": 100, "currency": "USD", "merchant_id": 1234 } timestamp = str(int(time.time() * 1000)) # 当前时间戳(毫秒) nonce = str(random.randint(100000, 999999)) # 随机数 # 构造签名字符串 message = f"{timestamp}\n{nonce}\n{method}\n{path}\n{api_key}\n" + "&".join([f"{k}={v}" for k, v in params.items()]) # 生成 HMAC-SHA256 签名 signature = hmac.new( secret_key.encode("utf-8"), message.encode("utf-8"), hashlib.sha256 ).hexdigest() # 构建请求头 headers = { "Authorization": f"Signature {signature}", "ACCESS-KEY": api_key, "ACCESS-TIMESTAMP": timestamp, "ACCESS-NONCE": nonce, "RECV-WINDOW": str(recv_window), "Content-Type": "application/json" } # 发送请求 response = requests.post( base_url + path, headers=headers, json=params ) # 输出响应 print(response.status_code) print(response.json()) ``` ### 时间戳与 recvWindow 的处理 时间戳用于防止重放攻击,确保请求在指定的时间窗口内有效。`recvWindow` 参数定义了服务器允许请求延迟的最大时间范围(单位为毫秒),超出该窗口的请求将被拒绝。客户端应确保本地时钟与服务器同步,以避免因时间偏差导致请求失败。 ### 安全验证机制 签名机制结合 API-KEY、时间戳、随机数(nonce)和请求参数,确保每个请求的唯一性和不可伪造性。服务器端通过相同的签名算法验证请求签名,若签名不匹配或时间戳过期,则拒绝该请求。该机制可有效防止中间人攻击和请求篡改。 ###
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值