海康车辆控制请求流程说明 - sessionLogin形式

海康车辆控制请求流程说明 - sessionLogin形式

1. 通过/ISAPI/Security/sessionLogin/capabilities?username=<用户名>接口获取 登录挑战值以及sessionID

// 1. 获取sessionId String userName = "账号"; String passWord = "密码"; String getSessionIdUrl = "http://IP/ISAPI/Security/sessionLogin/capabilities?username="+userName; String getSessionBody = HttpRequest.get(getSessionIdUrl) .execute().body(); // XML解析为JSON JSONObject getSessionXMLToJson = JSONUtil.xmlToJson(getSessionBody); // 获取挑战值以及sessionID HKSessionRespEntity SessionRespEntityBean = JSONUtil.toBean(getSessionXMLToJson.get("SessionLoginCap").toString(), HKSessionRespEntity.class); String challenge = SessionRespEntityBean.getChallenge(); String sessionId = SessionRespEntityBean.getSessionID();

2. 通过/ISAPI/Security/sessionLogin获取webSession

1. 主要方法

// 2. 请求sessionLogin接口获取webSession String getWebSessionUrl = "http:IP/ISAPI/Security/sessionLogin?timeStamp="+System.currentTimeMillis(); String sha256 = getSHA256(userName, passWord, challenge); String postParam = "<SessionLogin><userName>"+userName+"</userName><password>"+sha256+"</password><sessionID>"+sessionId+"</sessionID></SessionLogin>"; // 获取webSession HttpResponse webSessionBody = HttpRequest.post(getWebSessionUrl) .body(postParam) .execute(); // XML转化为JSON JSONObject getWebSessionXMLToJson = JSONUtil.xmlToJson(webSessionBody.body()); // 获取通过验证后的sessionID即webSession String webSession = getWebSessionXMLToJson.getByPath("SessionUserCheck.sessionID").toString();

2. 获取sha256 – 根据海康utils中密码加密方法转化

/** * sha256 * @param userName 用户名 * @param password 密码 * @param challenge 挑战值 * @return * @throws NoSuchAlgorithmException */ public String getSHA256(String userName, String password, String challenge) throws NoSuchAlgorithmException { MessageDigest digest = MessageDigest.getInstance("SHA-256"); String salt = ""; int iterations = 100; String sha256Code = ""; boolean hasSalt = (salt != null && !salt.isEmpty()); if (hasSalt) { // 【新协议】第一步：SHA256(用户名 + salt + 密码) String step1Input = userName + salt + password; sha256Code = bytesToHex(digest.digest(step1Input.getBytes(StandardCharsets.UTF_8))); // 【新协议】第二步：SHA256(上一步结果 + challenge) String step2Input = sha256Code + challenge; sha256Code = bytesToHex(digest.digest(step2Input.getBytes(StandardCharsets.UTF_8))); // 【新协议】第三步：从 i=2 开始循环迭代 for (int i = 2; i < iterations; i++) { sha256Code = bytesToHex(digest.digest(sha256Code.getBytes(StandardCharsets.UTF_8))); } } else { // 无盐第一步：SHA256(密码) 的十六进制字符串 + challenge // 注意：JS 中是 SHA256(e) + t.challenge，即把哈希后的 Hex 字符串与 challenge 拼接 String step1Hash = bytesToHex(digest.digest(password.getBytes(StandardCharsets.UTF_8))); sha256Code = step1Hash + challenge; // 无盐第二步：从 i=1 开始循环迭代 for (int i = 1; i < iterations; i++) { sha256Code = bytesToHex(digest.digest(sha256Code.getBytes(StandardCharsets.UTF_8))); } } return sha256Code; } /** * 字节数组转小写十六进制字符串 */ private static String bytesToHex(byte[] bytes) { StringBuilder sb = new StringBuilder(); for (byte b : bytes) sb.append(String.format("%02x", b)); return sb.toString(); }

3. 业务查询

请求头中必须添加Cookie字段，值为webSession，后续对于请求401接口的处理方式也一样

.header("Cookie", "WebSession="+webSession)