微信公众平台——验证消息真实性

微信公众平台——验证消息真实性

uses IdHashSHA, IdGlobal;

function SHA1(Input: String): String;
begin
with TIdHashSHA1.Create do
try
Result := LowerCase(HashBytesAsHex(TidBytes(Bytesof(Input))));
finally
Free;
end;
end;

function CheckSignature(ARequestInfo: TIdHTTPRequestInfo): boolean;
var
signature, timestamp, nonce, echostr: String;
tmpstr: TStringList;
temp: String;
begin
tmpstr := TStringList.Create;
try
signature := ARequestInfo.Params.Values['signature'];
timestamp := ARequestInfo.Params.Values['timestamp'];
nonce := ARequestInfo.Params.Values['nonce'];

echostr := ARequestInfo.Params.Values['echostr'];
tmpstr.Add(Token);
tmpstr.Add(timestamp);
tmpstr.Add(nonce);
tmpstr.Sort;
temp := StringReplace(tmpstr.text, #13#10, '', [rfReplaceAll]);
Result := SHA1(temp) = signature;
finally
tmpstr.Free;
end;
end;

procedure TForm1.IdHTTPServerCommandGet(AContext: TIdContext;
ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo);
begin
if CheckSignature(ARequestInfo) then
if ARequestInfo.Params.Values['echostr'] <> '' then
begin
AResponseInfo.ContentType := 'text/html; charset=UTF-8';
AResponseInfo.ContentText := ARequestInfo.Params.Values['echostr'];
end;
end;