WeChat public number develops WeChat access authentication as developer

I. Preface

This series of tutorials will be based on springboot2.1.8.RELEASE

This article will implement

  1. Registered account number
  2. Access to WeChat
  3. Certification as a developer

2, Enter wechat public platform to register account


Personal user suggested to register subscription number Finally, the registration was successful as follows:

3, Access authentication becomes developer

Please refer to official wechat development documents: https://mp.weixin.qq.com/wiki?t=resource/res_main&id=mp1421135319

1. Fill in server configuration

Select the developer tool at the bottom left to enter the test account development

There are many permissions for the test account. If the certified account does not need to be developed with the test account

Log in

Fill in server URL and custom verification Token


  1. WeChat public number interface must be http: / /, or https: / /, port 80 and port 443 are supported respectively!
  2. The url here can choose the server address you bought. Remember to open port 80 to use! Or use the intranet mapping and extranet tools to generate a domain name address for your development and use. This method uses Baidu itself, as follows~

2. Submit to verify URL validity

After configuration, click Submit. The wechat server will send a get request to the address we configured. In the background, get the request through the get request method. Several parameters will be passed in during the request Go back to the project, process wechat authentication, and then start the project test

Warm tip: here the editor maps his intranet to the Internet, which is convenient for local testing~

@Api(tags = "WeChat - Interface")
public class IndexController extends BaseController {

    // TODO here's token is matched on wechat public platform!
    private static final String token = "zhengqing";

     * Handling wechat authentication: verifying the validity of server address, get submission
     * signature: Wechat encryption signature combines the token parameter filled in by the developer with the timestamp parameter and nonce parameter in the request.
     * timestamp time stamp
     * nonce: random number
     * echostr: Random string
    public void checkSignature(HttpServletRequest request, HttpServletResponse response) throws IOException {
        System.out.println("============= Process wechat authentication ===============");
        // Get wechat request parameters
        String signature = request.getParameter("signature");
        String timestamp = request.getParameter("timestamp");
        String nonce = request.getParameter("nonce");
        String echostr = request.getParameter("echostr");

        // ① The three parameters of token, timestamp and nonce are sorted in lexicographic order B a D C H = = > A B C D H
        String[] strArr = {token, timestamp, nonce};
        // Dictionary ranking
        // ② Concatenate three parameter strings into a string for sha1 encryption
        StringBuffer sb = new StringBuffer();
        // String splicing
        for (String str : strArr) {
        // encryption
        String sha1Str = SecurityUtil.sha1(sb.toString());
        // ③ The encrypted string obtained by the developer can be compared with signature to identify that the request originates from wechat
        if (sha1Str.equals(signature)) {
            // If it is equal, it is from wechat request
            // If you confirm that the GET request comes from the wechat server and returns the contents of the echostr parameter as is, the access takes effect


Where sha1 encryption tool class

public class SecurityUtil {
	public static String sha1(String str) {
		try {
			StringBuilder sb = new StringBuilder();
			MessageDigest digest = MessageDigest.getInstance("sha1");
			// Put encrypted string
			// Encrypt
			byte[] digestMsg = digest.digest();
			// byte conversion hex
			for (byte b : digestMsg) {
				sb.append(String.format("%02x", b));
			return sb.toString();
		} catch (NoSuchAlgorithmException e) {
		return str;

Note that the port must be 80!!!

3. Test access authentication

After starting the project, return to wechat public platform and submit the request for sending access authentication. If the configuration is correct, it will prompt that the configuration is successful and save the configuration information

In this way, we simply completed wechat authentication and became a developer~

demo source code of this case


Tags: Programming SHA1 Java

Posted on Thu, 16 Jan 2020 01:54:45 -0500 by galayman