微信token认证方法原理

 var http = require('http');
 var url = require("url");
 var crypto = require("crypto");
 var port = 18080;

 function sha1(str){
     var md5sum = crypto.createHash("sha1");
     md5sum.update(str);
     str = md5sum.digest("hex");
     return str;
 }

 function validateToken(req,res){
     var query = url.parse(req.url,true).query;
     //console.log("*** URL:" + req.url);
     //console.log(query);
     var signature = query.signature;
     var echostr = query.echostr;
     var timestamp = query['timestamp'];
     var nonce = query.nonce;
     var oriArray = new Array();
     oriArray[0] = nonce;
     oriArray[1] = timestamp;
     oriArray[2] = "token";//这里是你在微信开发者中心页面里填的token，而不是****
     oriArray.sort();
     var original = oriArray.join('');
     console.log("Original str : " + original);
     console.log("Signature : " + signature );
     var scyptoString = sha1(original);
     if(signature == scyptoString){
         res.end(echostr);
         console.log("Confirm and send echo back");
     }else {
         res.end("false");
         console.log("Failed!");
     }
 }

 var webSvr = http.createServer(validateToken);
 webSvr.listen(port,function(){
     console.log("Start validate");
 });

与PHP的源码有异曲同工之处;

 private function checkSignature()
 {
         $signature = $_GET["signature"];
         $timestamp = $_GET["timestamp"];
         $nonce = $_GET["nonce"];    

     $token = TOKEN;
     $tmpArr = array($token, $timestamp, $nonce);
     sort($tmpArr, SORT_STRING);
     $tmpStr = implode( $tmpArr );
     $tmpStr = sha1( $tmpStr );

     if( $tmpStr == $signature ){
         return true;
     }else{
         return false;
     }
 }

再看小新写的nodejs版本;

 var http = require('http');
 var crypto = require('crypto');

 var server = http.createServer(); 

 server.on('request',function (req, res){
   res.writeHead(200, {'Content-Type': 'text/plain'}); 

   var signature = require('url').parse(req.url,true).query.signature
   var timestamp = require('url').parse(req.url,true).query.timestamp
   var echostr = require('url').parse(req.url,true).query.echostr
   var nonce = require('url').parse(req.url,true).query.nonce
   var token = 'Token';
   var tmpArr = Array(token, timestamp, nonce).sort().join("");
   var sha1 = crypto.createHash('sha1');
   sha1.update(tmpArr);
   tmpArr = sha1.digest('hex');
   if(tmpArr == signature){
     res.end(echostr);
   }else{
     res.end('404');
   }

 }); 

 server.listen(8088);

大体思路就是接受微信服务器发来的请求;

拆分参数;将参数排序、拼接、加密，与参数其中之一比对；

成功返回其中参数之一；

失败false；