需要传4个参数:timestamp、nonce、msg_signature 进行解密获取 ComponentVerifyTicket
但是微信文档没有写明白的是 post过来的 xml 里面 只有 appid 和 加密后的字符串encrypt 其他 参数需要另行获取
用request.getParameter() 或者 直接使用@RequestParam 注解获取
然后就进行下一步的解密了
我用的官方的例子。。。但是很奇怪的问题是
notepad++打开的 0.0
XMLParse 这个类里面的方法 是需要Encrypt 和ToUserName的
然后我就把WXBizMsgCrypt.decryptMsg()方法改成以下代码:
public String decryptMsg(String msgSignature, String timeStamp, String nonce, String encrypt)
throws AesException {
// 密钥,公众账号的app secret
// 提取密文
// Object[] encrypt = XMLParse.extract(postData);
// 验证安全签名
String signature = SHA1.getSHA1(token, timeStamp, nonce, encrypt);
// 和URL中的签名比较是否相等
// System.out.println("第三方收到URL中的签名:" + msg_sign);
// System.out.println("第三方校验签名:" + signature);
if (!signature.equals(msgSignature)) {
throw new AesException(AesException.ValidateSignatureError);
}
// 解密
String result = decrypt(encrypt);
return result;
}
最后调用这个方法
@ResponseBody
@RequestMapping(value = "/authorization/callBack", method ={RequestMethod.POST,RequestMethod.GET})
@ApiOperation(value = "接收授权事件")
public Result<String> authorizationCallBack(HttpServletRequest request,HttpServletResponse response,
@RequestBody String xml,
@RequestParam(value = "signature", required = false) String signature,
@RequestParam(value = "timestamp", required = false) String timeStamp,
@RequestParam(value = "nonce", required = false) String nonce,
@RequestParam(value = "encrypt_type", required = false) String encryptType,
@RequestParam(value = "msg_signature", required = false) String msgSignature
) throws Exception {
logger.info("authorizationXml = "+xml);
logger.info("signature = "+signature +" timeStamp ="+timeStamp +" nonce = "+nonce+" msgSignature ="+msgSignature);
//TODO 未完成
String encodingAesKey = "值";
String token = "值";
String appId = "值";
WXBizMsgCrypt pc = new WXBizMsgCrypt(token, encodingAesKey, appId);
WxAuthorizationCallBackEvent bean = JaxbUtil.converyToJavaBean(xml, WxAuthorizationCallBackEvent.class);
String decryptMsg = pc.decryptMsg(msgSignature, timeStamp, nonce, bean.getEncrypt());
logger.info("【success】 =" + decryptMsg);
response.getWriter().write("success");
response.getWriter().flush();
response.getWriter().close();
return null;
}
打印出来的 decryptMsg 等于
<xml>
<AppId>值</AppId>
<CreateTime>值</CreateTime>
<InfoType>component_verify_ticket<InfoType>
<ComponentVerifyTicket>一大串东西<ComponentVerifyTicket>
</xml>
然后就大功告成咯!
不知道是不是我的用法有问题还是。。。微信demo这个例子已经过时了(⊙o⊙)…?