1 package com.gede.wechat.util;
 2 
 3 import java.security.MessageDigest;
 4 import java.security.NoSuchAlgorithmException;
 5 import java.util.Arrays;
 6 
 7 /**
 8 * @author gede
 9 * @version date：2019年5月22日 下午2:50:43
10 * @description ：
11 */
12 public class SignUtil {  
13     // 与接口配置信息中的 Token 要一致   
14     private static String token = "gede";  
15     /** 
16      * 验证签名 
17      * @param signature 
18      * @param timestamp 
19      * @param nonce 
20      * @return 
21      */  
22     public static boolean checkSignature(String signature, String timestamp, String nonce) {  
23         String[] arr = new String[] { token, timestamp, nonce };  
24         // 将 token、timestamp、nonce 三个参数进行字典序排序   
25         Arrays.sort(arr);  
26         StringBuilder content = new StringBuilder();  
27         for (int i = 0; i < arr.length; i++) {  
28             content.append(arr[i]);  
29         }  
30         MessageDigest md = null;  
31         String tmpStr = null;  
32 
33         try {  
34             md = MessageDigest.getInstance("SHA-1");  
35             // 将三个参数字符串拼接成一个字符串进行 sha1 加密   
36             byte[] digest = md.digest(content.toString().getBytes());  
37             tmpStr = byteToStr(digest);  
38         } catch (NoSuchAlgorithmException e) {  
39             e.printStackTrace();  
40         }  
41 
42         content = null;  
43         // 将 sha1 加密后的字符串可与 signature 对比，标识该请求来源于微信   
44         return tmpStr != null ? tmpStr.equals(signature.toUpperCase()) : false;  
45     }  
46 
47     /** 
48      * 将字节数组转换为十六进制字符串 
49      * @param byteArray 
50      * @return 
51      */  
52     private static String byteToStr(byte[] byteArray) {  
53         String strDigest = "";  
54         for (int i = 0; i < byteArray.length; i++) {  
55             strDigest += byteToHexStr(byteArray[i]);  
56         }  
57         return strDigest;  
58     }  
59 
60     /** 
61      * 将字节转换为十六进制字符串 
62      * @param mByte 
63      * @return 
64      */  
65     private static String byteToHexStr(byte mByte) {  
66         char[] Digit = { ''0'', ''1'', ''2'', ''3'', ''4'', ''5'', ''6'', ''7'', ''8'', ''9'', ''A'', ''B'', ''C'', ''D'', ''E'', ''F'' };  
67         char[] tempArr = new char[2];  
68         tempArr[0] = Digit[(mByte >>> 4) & 0X0F];  
69         tempArr[1] = Digit[mByte & 0X0F];  
70         String s = new String(tempArr);  
71         return s;  
72     }  
73 }

 1 package com.gede.wechat.controller;
 2 
 3 import java.io.PrintWriter;
 4 
 5 import javax.servlet.http.HttpServletRequest;
 6 import javax.servlet.http.HttpServletResponse;
 7 
 8 import org.apache.log4j.Logger;
 9 import org.springframework.stereotype.Controller;
10 import org.springframework.web.bind.annotation.RequestMapping;
11 import org.springframework.web.bind.annotation.RequestMethod;
12 import org.springframework.web.bind.annotation.RequestParam;
13 
14 import com.gede.wechat.util.SignUtil;
15 
16 /**
17 * @author gede
18 * @version date：2019年5月22日 下午2:53:46
19 * @description ：
20 */
21 @Controller
22 @RequestMapping("/wechat")
23 public class WechatSecurity {
24     private static Logger logger = Logger.getLogger(WechatSecurity.class);
25  
26     @RequestMapping(value = "security", method = RequestMethod.GET)
27     public void doGet(
28             HttpServletRequest request,
29             HttpServletResponse response,
30             @RequestParam(value = "signature", required = true) String signature,
31             @RequestParam(value = "timestamp", required = true) String timestamp,
32             @RequestParam(value = "nonce", required = true) String nonce,
33             @RequestParam(value = "echostr", required = true) String echostr) {
34         try {
35             if (SignUtil.checkSignature(signature, timestamp, nonce)) {
36                 PrintWriter out = response.getWriter();
37                 out.print(echostr);
38                 out.close();
39             } else {
40                 logger.info("这里存在非法请求！");
41             }
42         } catch (Exception e) {
43             logger.error(e, e);
44         }
45     }
46  
47     @RequestMapping(value = "security", method = RequestMethod.POST)
48     // post方法用于接收微信服务端消息
49     public void DoPost() {
50         System.out.println("这是post方法！");
51     }
52 }

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.1.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd">
    <mvc:annotation-driven></mvc:annotation-driven> 
    <mvc:default-servlet-handler/>
    <context:component-scan base-package="com.gede.wechat.controller"></context:component-scan>
    <bean id="viewResolver"
        class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix" value="/WEB-INF/"></property>
        <property name="suffix" value=".jsp"></property>
    </bean>
</beans>

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <display-name>mychat</display-name>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:applicationContext.xml</param-value>
  </context-param>
  
  <servlet>
      <servlet-name>appServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>
            classpath:appServlet.xml
            </param-value>
        </init-param>
      <load-on-startup>1</load-on-startup>
  </servlet>

　　<servlet-mapping>
　　　　<servlet-name>appServlet</servlet-name>
　　　　<url-pattern>/</url-pattern>
　　</servlet-mapping>

</web-app>

package com.cuiyongzhi.wechat.util;
 
import java.security.MessageDigest; 
import java.security.NoSuchAlgorithmException; 
import java.util.Arrays; 
 
/**
 * ClassName: SignUtil
 * @Description: 请求校验工具类 
 * @author dapengniao
 * @date 2016年3月4日 下午6:25:41
 */
public class SignUtil { 
 // 与接口配置信息中的Token要一致 
 private static String token = "dapengniaowechat"; 
 /** 
 * 验证签名 
 * @param signature 
 * @param timestamp 
 * @param nonce 
 * @return 
 */ 
 public static boolean checkSignature(String signature,String timestamp,String nonce) { 
 String[] arr = new String[] { token,timestamp,nonce }; 
 // 将token、timestamp、nonce三个参数进行字典序排序 
 Arrays.sort(arr); 
 StringBuilder content = new StringBuilder(); 
 for (int i = 0; i < arr.length; i++) { 
 content.append(arr[i]); 
 } 
 MessageDigest md = null; 
 String tmpStr = null; 
 
 try { 
 md = MessageDigest.getInstance("SHA-1"); 
 // 将三个参数字符串拼接成一个字符串进行sha1加密 
 byte[] digest = md.digest(content.toString().getBytes()); 
 tmpStr = bytetoStr(digest); 
 } catch (NoSuchAlgorithmException e) { 
 e.printstacktrace(); 
 } 
 
 content = null; 
 // 将sha1加密后的字符串可与signature对比，标识该请求来源于微信 
 return tmpStr != null ? tmpStr.equals(signature.toupperCase()) : false; 
 } 
 
 /** 
 * 将字节数组转换为十六进制字符串 
 * @param byteArray 
 * @return 
 */ 
 private static String bytetoStr(byte[] byteArray) { 
 String strDigest = ""; 
 for (int i = 0; i < byteArray.length; i++) { 
 strDigest += bytetoHexStr(byteArray[i]); 
 } 
 return strDigest; 
 } 
 
 /** 
 * 将字节转换为十六进制字符串 
 * @param mByte 
 * @return 
 */ 
 private static String bytetoHexStr(byte mByte) { 
 char[] Digit = { '0','1','2','3','4','5','6','7','8','9','A','B','C','D','E','F' }; 
 char[] tempArr = new char[2]; 
 tempArr[0] = Digit[(mByte >>> 4) & 0X0F]; 
 tempArr[1] = Digit[mByte & 0X0F]; 
 String s = new String(tempArr); 
 return s; 
 } 
}

package com.cuiyongzhi.wechat.controller;
 
import java.io.PrintWriter;
 
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
 
import org.apache.log4j.Logger;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
 
import com.cuiyongzhi.wechat.util.SignUtil;
 
@Controller
@RequestMapping("/wechat")
public class WechatSecurity {
 private static Logger logger = Logger.getLogger(WechatSecurity.class);
 
 /**
 * 
 * @Description: 用于接收get参数，返回验证参数
 * @param @param request
 * @param @param response
 * @param @param signature
 * @param @param timestamp
 * @param @param nonce
 * @param @param echostr
 * @author dapengniao
 * @date 2016年3月4日 下午6:20:00
 */
 @RequestMapping(value = "security",method = RequestMethod.GET)
 public void doGet(
 HttpServletRequest request,HttpServletResponse response,@RequestParam(value = "signature",required = true) String signature,@RequestParam(value = "timestamp",required = true) String timestamp,@RequestParam(value = "nonce",required = true) String nonce,@RequestParam(value = "echostr",required = true) String echostr) {
 try {
 if (SignUtil.checkSignature(signature,nonce)) {
 PrintWriter out = response.getWriter();
 out.print(echostr);
 out.close();
 } else {
 logger.info("这里存在非法请求！");
 }
 } catch (Exception e) {
 logger.error(e,e);
 }
 }
 
 @RequestMapping(value = "security",method = RequestMethod.POST)
 // post方法用于接收微信服务端消息
 public void DoPost() {
 System.out.println("这是post方法！");
 }
}