微信第三方獲取component_verify_ticket接口

原創

2019-03-22 20:13

在第三方平臺創建審覈通過後，微信服務器會向其“授權事件接收URL”每隔10分鐘定時推送component_verify_ticket。第三方平臺方在收到ticket推送後也需進行解密（詳細請見【消息加解密接入指引】），接收到後必須直接返回字符串success。

1. 獲取component_verify_ticket接口配置

接口名要與微信開發平臺第三方平臺上配置的"授權事件接收URL"接口名對應。

例：getComponentVerifyTicket

2. 寫接口

/**
    * 接收component_verify_ticket 或 authorized事件
    */
   @SuppressWarnings({ "rawtypes", "unchecked" })
   @ApiOperation(value = "接收component_verify_ticket 或 authorized事件", notes = "接收component_verify_ticket 或 authorized事件", response = String.class)
   @RequestMapping(value = "getComponentVerifyTicket")
   public void getComponentVerifyTicket(HttpServletRequest request, HttpServletResponse response) throws Exception {
      logger.info("接收component_verify_ticket 或 authorized事件");
      String nonce = request.getParameter("nonce");
      String timestamp = request.getParameter("timestamp");
      String msgSignature = request.getParameter("msg_signature");

      StringBuilder sb = new StringBuilder();
      BufferedReader in = request.getReader();
      String line;
      while((line = in.readLine()) != null) {
         sb.append(line);
      }
      String postData = sb.toString();
      logger.info("nonce: " + nonce);
      logger.info("timestamp: " + timestamp);
      logger.info("msgSignature: " + msgSignature);
      logger.info("postData: " + postData);
      thirdPartyService.getComponentVerifyTicket(timestamp, nonce, msgSignature, postData);
      responseUtil(response, "success");
//    return "success";
   }

@Override
public void getComponentVerifyTicket(String timestamp, String nonce, String msgSignature, String postData) throws Exception {
   // 需要加密的明文
   WXBizMsgCrypt pc = new WXBizMsgCrypt(TOKEN, ENCODING_AES_KEY, THIRD_PARTY_APP_ID);

   DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
   dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
   dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
   dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
   dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
   dbf.setXIncludeAware(false);
   dbf.setExpandEntityReferences(false);
   DocumentBuilder db = dbf.newDocumentBuilder();
   StringReader sr = new StringReader(postData);
   InputSource is = new InputSource(sr);
   Document document = db.parse(is);

   Element root = document.getDocumentElement();
   NodeList nodelist1 = root.getElementsByTagName("Encrypt");
   String encrypt = nodelist1.item(0).getTextContent();

   String format = "<xml><ToUserName><![CDATA[toUser]]></ToUserName><Encrypt><![CDATA[%1$s]]></Encrypt></xml>";
   String fromXML = String.format(format, encrypt);

   String result = pc.decryptMsg(msgSignature, timestamp, nonce, fromXML);
   logger.info("解密後: " + result);

   //獲取ComponentVerifyTicket
   Map<String, String> xmlMap = xmlToMap(result);
   String componentVerifyTicket = xmlMap.get("ComponentVerifyTicket");
   if(StringUtils.isNotBlank(componentVerifyTicket)) {
      //獲取ticket,沒有則爲authorized事件
      RedisUtils.set("ComponentVerifyTicket", componentVerifyTicket);
      logger.info("ComponentVerifyTicket: " + componentVerifyTicket);
   }
}

3. 坑

a. 需要注意的是這個接口會有兩種數據形式訪問，一個是component_verify_ticket,解密後有ComponentVerifyTicket這個參數，另一個是authorized事件，解密後沒有ComponentVerifyTicket這個參數，因此在獲取componentVerifyTicket時要加個判斷。