支付宝接口调用返回参数验证签名采坑

一、同步返回参数和同步响应参数的区别

  1.同步返回的参数是指在接口的请求参数中传入return_url参数，在支付成功后在return_url地址后面返回的如：

https://m.alipay.com/Gk8NF23?total_amount=9.00&timestamp=2016-08-11+19%3A36%3A01&sign=ErCRRVmW%2FvXu1XO76k%2BUr4gYKC5%2FWgZGSo%2FR7nbL%2FPU7yFXtQJ2CjYPcqumxcYYB5x%2FzaRJXWBLN3jJXr01Icph8AZGEmwNuzvfezRoWny6%2Fm0iVQf7hfgn66z2yRfXtRSqtSTQWhjMa5YXE7MBMKFruIclYVTlfWDN30Cw7k%2Fk%3D&trade_no=2016081121001004630200142207&sign_type=RSA2&charset=UTF-8&seller_id=2088111111116894&method=alipay.trade.wap.pay.return&app_id=2016040501024706&out_trade_no=70501111111S001111119&version=1.0

 2.同步响应的参数是指调用接口，接口响应的参数，以退款接口的响应参数为例：

{"alipay_trade_refund_response":{"code":"10000","msg":"Success","buyer_logon_id":"dvr***@sandbox.com","buyer_user_id":"2088102174881929","fund_change":"Y","gmt_refund_pay":"2018-06-20 10:51:02","out_trade_no":"2018620104753419","refund_fee":"0.01","send_back_fee":"0.00","trade_no":"2018062021001004920200514505"},"sign":"A/XC4scJe8dF/Gv29g/dzf6bkBtz5H0pnv4eDZzEpz/0QFlQFNqk9dSS072MTZMbZO1h9M//8PntWCNPRQAEYdkS4vBVcHPbJnDkdFjD75bI/ZwXZEJaH4OWmkV4vvJD4/K1MVXLRXpiKtzwVMPGyBn0L2YvfIi3I/5dOGPYwI2sq6NalCfJydr3dwJ4Jf36Od/5jnofMv0IE2joyReywQhL45vOtGzsJhvJ5WUsxezuyK3UJ4SXmy6dNZb1qGRNlYeoaLiKTQ50GOpe7IdQsBOFz88Tg/DcqRgbrTak97A3WOYiTWG2HgD5nRWOmHrQ6KdJbfiYzYSfkjUmwly19g=="}

二、验签

  同步返回的参数和同步响应的参数都是可以使用SDK封装的

boolean flag = AlipaySignature.rsaCheckV1(params, alipaypublicKey, charset,"RSA2")

方法来验签，params参数就是同步响应或是返回的参数 但是同步响应的参数是json格式的 在处理的时候如果处理不好可能会导致验签失败，此时建议大家可以使用下面的方法来验证同步的响应参数

1、使用RSA格式的秘钥验签同步响应参数，以上面的退款同步的响应参数为例：

//处理返回的信息
String content="{\"code\":\"10000\",\"msg\":\"Success\",\"buyer_logon_id\":\"dvr***@sandbox.com\",\"buyer_user_id\":\"2088102174881929\",\"fund_change\":\"Y\",\"gmt_refund_pay\":\"2018-06-20 10:51:02\",\"out_trade_no\":\"2018620104753419\",\"refund_fee\":\"0.01\",\"send_back_fee\":\"0.00\",\"trade_no\":\"2018062021001004920200514505\"}";
//传入支付宝公钥
String publicKey="MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1SvGfJX2+z3RK4IPVI9ob3V+Q7hS8Zjo/yeUzHlkzyZ2ifq1KGxpOUYNK+UpkDxpMfy9xDWp94FWfMgug3VfsbhH/3YQFuMe4JJ/d5MIWA7zEqd4mWxFIL8UcQWMkpn+JmN6LJrT3ByrSjQ6fkaxc2sEB5rw87AOnW6JzLbWOKT4s1cXg6FK+DgHGhkMixIdIRwN43xycbrl2NYzR/iN2b7beyxhKRmQS0JFhGRGk7TQ02iuCoDe8228l1Khd8NuqWEJ4B31d1iSeUEZUmFxI/l3Aq9fb/ylwB3xjON6h5yG4jm+ntGHUUw09HQ4HegZsepUdnTZ5zYuCCSwwKHUqQIDAQAB";
//传入项目编码的格式
String charset="UTF-8";
//取出返回的响应参数的sign参数
String sign="A/XC4scJe8dF/Gv29g/dzf6bkBtz5H0pnv4eDZzEpz/0QFlQFNqk9dSS072MTZMbZO1h9M//8PntWCNPRQAEYdkS4vBVcHPbJnDkdFjD75bI/ZwXZEJaH4OWmkV4vvJD4/K1MVXLRXpiKtzwVMPGyBn0L2YvfIi3I/5dOGPYwI2sq6NalCfJydr3dwJ4Jf36Od/5jnofMv0IE2joyReywQhL45vOtGzsJhvJ5WUsxezuyK3UJ4SXmy6dNZb1qGRNlYeoaLiKTQ50GOpe7IdQsBOFz88Tg/DcqRgbrTak97A3WOYiTWG2HgD5nRWOmHrQ6KdJbfiYzYSfkjUmwly19g==";
//传入验签使用的秘钥的格式		
String signType="RSA";
			
boolean re=	AlipaySignature.rsaCheck(content, sign, publicKey, charset, signType);

2、使用RSA2格式的秘钥验签同步响应参数，同样以上面的退款同步的响应参数为例：

 //处理返回的信息
String content="{\"code\":\"10000\",\"msg\":\"Success\",\"buyer_logon_id\":\"dvr***@sandbox.com\",\"buyer_user_id\":\"2088102174881929\",\"fund_change\":\"Y\",\"gmt_refund_pay\":\"2018-06-20 10:51:02\",\"out_trade_no\":\"2018620104753419\",\"refund_fee\":\"0.01\",\"send_back_fee\":\"0.00\",\"trade_no\":\"2018062021001004920200514505\"}";
//传入支付宝公钥
String publicKey="MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1SvGfJX2+z3RK4IPVI9ob3V+Q7hS8Zjo/yeUzHlkzyZ2ifq1KGxpOUYNK+UpkDxpMfy9xDWp94FWfMgug3VfsbhH/3YQFuMe4JJ/d5MIWA7zEqd4mWxFIL8UcQWMkpn+JmN6LJrT3ByrSjQ6fkaxc2sEB5rw87AOnW6JzLbWOKT4s1cXg6FK+DgHGhkMixIdIRwN43xycbrl2NYzR/iN2b7beyxhKRmQS0JFhGRGk7TQ02iuCoDe8228l1Khd8NuqWEJ4B31d1iSeUEZUmFxI/l3Aq9fb/ylwB3xjON6h5yG4jm+ntGHUUw09HQ4HegZsepUdnTZ5zYuCCSwwKHUqQIDAQAB";
//传入项目编码的格式
String charset="UTF-8";
//取出返回的响应参数的sign参数
String sign="A/XC4scJe8dF/Gv29g/dzf6bkBtz5H0pnv4eDZzEpz/0QFlQFNqk9dSS072MTZMbZO1h9M//8PntWCNPRQAEYdkS4vBVcHPbJnDkdFjD75bI/ZwXZEJaH4OWmkV4vvJD4/K1MVXLRXpiKtzwVMPGyBn0L2YvfIi3I/5dOGPYwI2sq6NalCfJydr3dwJ4Jf36Od/5jnofMv0IE2joyReywQhL45vOtGzsJhvJ5WUsxezuyK3UJ4SXmy6dNZb1qGRNlYeoaLiKTQ50GOpe7IdQsBOFz88Tg/DcqRgbrTak97A3WOYiTWG2HgD5nRWOmHrQ6KdJbfiYzYSfkjUmwly19g==";

boolean req=AlipaySignature.rsa256CheckContent(content, sign, publicKey,charset);

注意：

这边的是使用RSA验签还是RSA2 是依据商户自己请求的时候使用的秘钥格式是RSA还是RSA2来确定的 只能使用对应的格式的秘钥来验签，否则就会验签失败  这边示例的退款的请求信息中我这边使用的是RSA2的秘钥 所以使用RSA的验签代码就会验签失败的 建议只参考传参方式  如果使用RSA2的秘钥格式来验签是可以成功的