微信token认证方法原理

var http = require('http');
var url = require("url");
var crypto = require("crypto");
var port = 18080;

function sha1(str){
    var md5sum = crypto.createHash("sha1");
    md5sum.update(str);
    str = md5sum.digest("hex");
    return str;
}

function validateToken(req,res){
    var query = url.parse(req.url,true).query;
    //console.log("*** URL:" + req.url);
    //console.log(query);
    var signature = query.signature;
    var echostr = query.echostr;
    var timestamp = query['timestamp'];
    var nonce = query.nonce;
    var oriArray = new Array();
    oriArray[0] = nonce;
    oriArray[1] = timestamp;
    oriArray[2] = "token";//这里是你在微信开发者中心页面里填的token，而不是****
    oriArray.sort();
    var original = oriArray.join('');
    console.log("Original str : " + original);
    console.log("Signature : " + signature );
    var scyptoString = sha1(original);
    if(signature == scyptoString){
        res.end(echostr);
        console.log("Confirm and send echo back");
    }else {
        res.end("false");
        console.log("Failed!");
    }
}


var webSvr = http.createServer(validateToken);
webSvr.listen(port,function(){
    console.log("Start validate");
});

与PHP的源码有异曲同工之处;

private function checkSignature()
{
        $signature = $_GET["signature"];
        $timestamp = $_GET["timestamp"];
        $nonce = $_GET["nonce"];    
                
    $token = TOKEN;
    $tmpArr = array($token, $timestamp, $nonce);
    sort($tmpArr, SORT_STRING);
    $tmpStr = implode( $tmpArr );
    $tmpStr = sha1( $tmpStr );
    
    if( $tmpStr == $signature ){
        return true;
    }else{
        return false;
    }
}

再看小新写的nodejs版本;

var http = require('http');
var crypto = require('crypto');
 
var server = http.createServer(); 
   
server.on('request',function (req, res){ 
  res.writeHead(200, {'Content-Type': 'text/plain'}); 
   
  var signature = require('url').parse(req.url,true).query.signature
  var timestamp = require('url').parse(req.url,true).query.timestamp
  var echostr = require('url').parse(req.url,true).query.echostr
  var nonce = require('url').parse(req.url,true).query.nonce
  var token = 'Token';
  var tmpArr = Array(token, timestamp, nonce).sort().join("");
  var sha1 = crypto.createHash('sha1');
  sha1.update(tmpArr);
  tmpArr = sha1.digest('hex');
  if(tmpArr == signature){
    res.end(echostr);  
  }else{
    res.end('404');
  }
   
}); 
 
server.listen(8088);

大体思路就是接受微信服务器发来的请求;

拆分参数;将参数排序、拼接、加密，与参数其中之一比对；

成功返回其中参数之一；

失败false；