The working principle of the WeChat public platform message interface can be roughly understood like this: the process from the user end to the public account end is like this. The user sends a message to the WeChat server, and the WeChat server will receive it. The message is posted to the URL filled in by the user when accessing. In the URL handler, the legitimacy of the message is first judged. After successful judgment, the corresponding response is made based on the content of the message body. The principle is easy to understand, and it may be easier for those who have been exposed to sockets.

However, WeChat’s documentation is sometimes a bit confusing, and the documentation on WeChat access is really not flattering. The first step in the official document is to "apply for a message interface". Here you need to fill in a URL. This URL is used to process messages sent by WeChat, but WeChat writes the relevant configuration in the URL in the second step. Be careful and you will screw up newbies. Below I will explain it according to my understanding.

First of all, when the developer accesses, the WeChat server will send a get request to the URL you filled in. This request carries four parameters, respectively signature (WeChat encrypted signature, signature combination The token parameter filled in by the developer and the timestamp parameter and nonce parameter in the request), timestamp (Timestamp), nonce (random number), echostr (random string). .Use HttpContext.Current.Request.RawUrl to obtain the original URL of the current request, as shown in the following figure:

The developer verifies the request by checking the signature (see below) verification method). If it is confirmed that this GET request comes from the WeChat server, please return the echostr parameter content as it is, then the access will take effect and you will become a developer successfully, otherwise the access will fail.

加密/校驗流程如下：1.?將token、timestamp、nonce三個參數(shù)進行字典序排序
2.?將三個參數(shù)字符串拼接成一個字符串進行sha1加密
3.?開發(fā)者獲得加密后的字符串可與signature對比，標識該請求來源于微信。

下面是代碼實現(xiàn)。

首先，在你的處理程序中（我是新建了一個一般處理程序wx.ashx）,判斷當前請求的類型，因為接入時，是發(fā)送的GET請求，消息處理是發(fā)送的POST請求。如下圖：

這里我對驗證url的方法進行封裝。

/// <summary>
        /// 驗證url權限， 接入服務器        /// </summary>
        /// <param name="token"></param>
        /// <returns></returns>
        public static bool ValidUrl(string token)
        {            string echoStr = VqiRequest.GetQueryString("echoStr");            if (CheckSignature(token))
            {                if (!string.IsNullOrEmpty(echoStr))
                {
                    Utils.ResponseWrite(echoStr);                    return true;
                }

            }            return false;
        }/// <summary>
        /// 驗證微信簽名        /// </summary>
        /// * 將token、timestamp、nonce三個參數(shù)進行字典序排序        /// * 將三個參數(shù)字符串拼接成一個字符串進行sha1加密        /// * 開發(fā)者獲得加密后的字符串可與signature對比，標識該請求來源于微信。        /// <returns></returns>
        public static bool CheckSignature(string token)
        {            string signature = VqiRequest.GetQueryString("signature");            string timestamp = VqiRequest.GetQueryString("timestamp");            string nonce = VqiRequest.GetQueryString("nonce");            string[] ArrTmp = { token, timestamp, nonce };
            Array.Sort(ArrTmp);     //字典排序
            string tmpStr = string.Join("", ArrTmp);
            tmpStr = Utils.HashPasswordForStoringInConfigFile(tmpStr, "SHA1");
            tmpStr = tmpStr.ToLower();            if (tmpStr == signature)
            {                return true;
            }            else
            {                return false;
            }
        }

Note: The code VqiRequest.GetQueryString is the encapsulated QueryString request method. When used, it can be changed to QueryString[""]

The processing process is as shown in the figure:

Put the three parameters signature, timestamp and nonce in the array,

Sorted ArrTmp:

Concatenate the three parameter strings into one string:

Encrypt tmpStr with sha1, and convert the encrypted string into lowercase:

Then compare it with the signature, if it is the same, it means Verification successful.

If the verification is successful, echoStr will be returned to WeChat.

/// <summary>
        /// 根據(jù)指定的密碼和哈希算法生成一個適合于存儲在配置文件中的哈希密碼        /// </summary>
        /// <param name="str">要進行哈希運算的密碼</param>
        /// <param name="type"> 要使用的哈希算法</param>
        /// <returns>經(jīng)過哈希運算的密碼</returns>
        public static string HashPasswordForStoringInConfigFile(string str, string type)
        {            return FormsAuthentication.HashPasswordForStoringInConfigFile(str, type);
        }        public static void ResponseWrite(string str)
        {
            HttpContext.Current.Response.Write(str);
            HttpContext.Current.Response.End();
        }

After the handler is written, deploy it to iis (please refer to Tutorial 1 for the method), log in to the WeChat management background mp.weixin. qq.com/ On the developer center page, click the "Modify Configuration Button" to fill in the URL, Token and EncodingAESKey, where the URL is the interface URL used by developers to receive WeChat server data. The token can be filled in by the developer arbitrarily and used to generate a signature (the token will be compared with the token contained in the interface URL to verify the security). EncodingAESKey is manually filled in by the developer or randomly generated, and will be used as the message body encryption and decryption key. At the same time, developers can choose message encryption and decryption methods: plaintext mode, compatibility mode and security mode. The mode selection and server configuration will take effect immediately after submission. The default state of the encryption and decryption method is plaintext mode. The encryption and decryption modes will be shared with you in a later series, so stay tuned.

As shown in the picture:

##After clicking submit, the WeChat server Request get to the url written above. If the verification is successful, the binding is successful.

END

[Related recommendations]

1.

WeChat public account platform source code download

2.

WeChat voting system source code

The above is the detailed content of Newbie Access Guide to WeChat Development Department. For more information, please follow other related articles on the PHP Chinese website!