微信支付商家转账回调验签方法与解密方法

第一步安装SDKcomposer require wechatpay/wechatpay第二步SDK代码实现use WeChatPay\Crypto\Rsa; use WeChatPay\Crypto\AesGcm; use WeChatPay\Formatter; use WeChatPay\Exception\InvalidArgumentException; use Illuminate\Http\JsonResponse; class WithdrawalController extends Controller { public function transfer(Request $request) { $curTime get_milli_second(); // 1. 从请求头获取微信支付签名信息/2. 获取请求的原始Body $header $request-header(); $body $request-getContent(); $wechatpaySignature $request-header(Wechatpay-Signature); $wechatpayTimestamp $request-header(Wechatpay-Timestamp); $wechatpayNonce $request-header(Wechatpay-Nonce); $wechatpaySerial $request-header(Wechatpay-Serial); // 3. 加载你的平台证书公钥请确保路径正确并替换为你的公钥ID $platformPublicKeyPath public_path(cert/apiclient_pub.pem); $platformPublicKeyInstance Rsa::from(file://.$platformPublicKeyPath, Rsa::KEY_TYPE_PUBLIC); // 4. 开始验签 // 构造验签名串时间戳 \n 随机串 \n 请求体 \n $message Formatter::joinedByLineFeed($wechatpayTimestamp, $wechatpayNonce, $body); $verified Rsa::verify($message, $wechatpaySignature, $platformPublicKeyInstance); // 5. 检查时间戳是否在允许的偏移范围内如5分钟 $timeIsValid abs(Formatter::timestamp() - (int)$wechatpayTimestamp) 300000; if ($verified $timeIsValid) { // 6. 验签通过解密数据 $inBodyArray json_decode($body, true); $resource $inBodyArray[resource] ?? []; if (!$resource) { Log::info(transferWX#回调通知内容为空#{$curTime}); return $this-failedResponse(回调通知内容为空); } try { $decrypted AesGcm::decrypt( $resource[ciphertext] ?? , config(pay.wechat_cook.key), // 从配置文件中读取你的APIv3密钥 $resource[nonce] ?? , $resource[associated_data] ?? ); $data json_decode($decrypted, true); if (!$data) { Log::info(transferWX#回调通知内容解密失败#{$curTime}); return $this-failedResponse(回调通知内容解密失败); } // 7. 处理业务逻辑更新订单状态等 \Log::info(微信支付回调成功, $data); // 例如Order::where(out_trade_no, $data[out_trade_no])-update([status paid]); // 8. 必须返回微信成功标识 Log::info(transferWX#操作成功#{$curTime}, $data??[]); return response(, 200); } catch (InvalidArgumentException $e) { Log::info(transferWX#解密回调数据失败#{$curTime}. $e-getMessage()); return $this-failedResponse(解密回调数据失败); } } Log::info(transferWX#微信支付回调验签失败#{$curTime}); return $this-failedResponse(微信支付回调验签失败); } private function failedResponse(string $message): JsonResponse { return response()-json([ code FAIL, message $message, ], 400); } }手动验签代码private function verifyWechatPaySignature(string $signature, string $timestamp, string $nonce, string $body, string $publicKeyPath): bool { // 1. 构造待验签的字符串 $message $timestamp . \n . $nonce . \n . $body . \n; // 2. 加载公钥 $publicKey openssl_pkey_get_public(file:// . $publicKeyPath); if (!$publicKey) { throw new \Exception(Invalid public key); } // 3. 验签 // 微信支付使用的是 SHA256 with RSA 签名 $signature base64_decode($signature); $result openssl_verify($message, $signature, $publicKey, OPENSSL_ALGO_SHA256); // 释放公钥资源 openssl_free_key($publicKey); return $result 1; }说明发起商家转账https://pay.wechatpay.cn/doc/v3/merchant/4012458841商家转账回调通知https://pay.weixin.qq.com/doc/v3/merchant/4012712115如何使用平台证书验签名如何使用平台证书验签名_通用规则|微信支付商户文档中心如何使用微信支付公钥验签如何使用微信支付公钥验签_通用规则|微信支付商户文档中心