WeChat official account official API development configuration server

Recently, for WeChat official API development, you need to know the user's openid, scan the code to pass parameters, and need to configure the server.

1. Server configuration

The WeChat official account needs to enable the developer mode, and then configure it in the bottom left corner of the development -> basic configuration -> server configuration, the page is as follows:

 

AppID: It is the unique identifier of the WeChat official account, which is verified with AppSecret.

URL: the path of the development server (you want to receive the interface address of the WeChat official return information, which is used to receive the data sent by the WeChat server, and an external network is required)

Token: Self-set token (can be set at will, and will be used later in URL interface joint debugging and verification, and must be consistent)

The relationship between WeChat official account users, WeChat server, and development server: When WeChat official account users send information, they send it to the WeChat server, and the WeChat server forwards the message to the development server. The interaction is through the interface.

2. Authentication server

After the developer submits the information, the WeChat server will send a GET request to the URL of the filled server address. The parameters of the GET request are as follows:

parameter	describe
signature	WeChat encrypted signature, signature combines the token parameter filled in by the developer and the timestamp parameter and nonce parameter in the request.
timestamp	timestamp
nonce	random number
echostr	Random string, to be returned as-is

The verification code is as follows:

//采用的是Jfinal框架，验证接口如下
public void verifyWXToken() throws AesException {
        logger.error("进入验证servlet！！！！！");
        Map<String, Object> paramsMap = getParamsMap();
        String msgSignature = paramsMap.get("signature")+"";
        String msgTimestamp = paramsMap.get("timestamp")+"";
        String msgNonce = paramsMap.get("nonce")+"";
        String echostr = paramsMap.get("echostr")+"";
        if (verifyUrl(msgSignature, msgTimestamp, msgNonce)) {
            renderText(echostr);
        }else
            failure("failure");
    }


//用到的方法
public static boolean verifyUrl(String msgSignature, String timeStamp, String nonce)
            throws AesException {
        // 这里的 Constants.TOKEN 填写你自己设置的Token就可以了
        String signature = getSHA1(Constants.WECHAT_TOKEN, timeStamp, nonce);
        if (!signature.equals(msgSignature)) {
            throw new AesException(AesException.VALIDATE_SIGNATURE_ERROR);
        }
        return true;
    }
//用SHA1算法验证Token
public static String getSHA1(String token, String timestamp, String nonce) throws AesException {
		try {
			String[] array = new String[] { token, timestamp, nonce };
			StringBuffer sb = new StringBuffer();
			// 字符串排序
			Arrays.sort(array);
			for (int i = 0; i < 3; i++) {
				sb.append(array[i]);
			}
			String str = sb.toString();
			// SHA1签名生成
			MessageDigest md = MessageDigest.getInstance("SHA-1");
			md.update(str.getBytes());
			byte[] digest = md.digest();

			StringBuffer hexstr = new StringBuffer();
			String shaHex = "";
			for (int i = 0; i < digest.length; i++) {
				shaHex = Integer.toHexString(digest[i] & 0xFF);
				if (shaHex.length() < 2) {
					hexstr.append(0);
				}
				hexstr.append(shaHex);
			}
			return hexstr.toString();
		} catch (Exception e) {
			e.printStackTrace();
			throw new AesException(AesException.COMPUTE_SIGNATURE_ERROR);
		}
	}

signature: signature combines the token parameter filled by the developer and the timestamp parameter and nonce parameter in the request. These three parameters are encrypted using the sha1 algorithm.

According to these three parameters, the sha1 algorithm is re-encrypted in the development server to generate a new signature, and then compared with the signature in the request parameter, if they are the same, the verification is successful, and a random string is returned after success. The configure phase is then successful.

3. Enable

After the configuration is complete and the verification is complete, click the "Enable" button, and the development server is officially completed.

After that, you can only interact with the official WeChat through the verifyWXToken interface, so you can only complete the development you need by modifying verifyWXToken.