微信 token 验证

package org.sxl.weixin;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;

import javax.servlet.http.HttpServletRequest;

public class WeiXinValidateToken {
    /**
     *
     * @param signature
     *            微信加密签名，signature结合了开发者填写的token参数和请求中的timestamp参数、nonce参数。
     * @param timestamp
     *            时间戳
     * @param nonce
     *            随机数
     * @param echostr
     *            随机字符串
     * @return 是否通过验证
     * @throws NoSuchAlgorithmException
     */
    public boolean Validate(String signature, String token, String timestamp, String nonce) throws NoSuchAlgorithmException {

        String[] array = new String[] { token, timestamp, nonce };
        StringBuffer sb = new StringBuffer();
        // 字符串排序
        Arrays.sort(array);
        for (int i = 0; i < 3; i++) {
            sb.append(array[i]);
        }
        String str = sb.toString();
        // SHA1签名生成
        MessageDigest md = MessageDigest.getInstance("SHA-1");
        md.update(str.getBytes());
        byte[] digest = md.digest();

        StringBuffer hexstr = new StringBuffer();
        String shaHex = "";
        for (int i = 0; i < digest.length; i++) {
            shaHex = Integer.toHexString(digest[i] & 0xFF);
            if (shaHex.length() < 2) {
                hexstr.append(0);
            }
            hexstr.append(shaHex);
        }

        if (signature.equals(hexstr)) {
            return true;
        } else {
            return false;
        }
    }

    /**
     *
     * @param request
     *            请求
     * @param token
     *            密钥
     * @return 随机数
     */
    public String ValidateRequest(HttpServletRequest request, String token) {
        String signature = request.getParameter("signature");
        String echostr = request.getParameter("echostr");
        String timestamp = request.getParameter("timestamp");
        String nonce = request.getParameter("nonce ");
        boolean val = false;
        try {
            val = Validate(signature, token, timestamp, nonce);
        } catch (NoSuchAlgorithmException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        if(val==true){
            return echostr;
        }else{
            return "";
        }

    }

}