Hacker and Geeker's Way

import com.google.common.base.Joiner;
import com.google.common.collect.Lists;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.*;

import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.Collections;
@Controller
public class MainController {
    private static final Log log = LogFactory.getLog(MainController.class);

    //从配置文件获取的token值，就是刚才在修改配置项里面定义的那个Token
    @Value("${token}")
    private String token;

    //定义一个GET请求，url为xxx/index
    @RequestMapping(value = "/index", method = RequestMethod.GET, produces = "text/html;charset=UTF-8")
    public
    @ResponseBody
    //接收新手指南里面提到的那4个参数
    ResponseEntity<String> auth(@RequestParam("signature") String signature,
                                @RequestParam("timestamp") String timestamp,
                                @RequestParam("nonce") String nonce,
                                @RequestParam("echostr") String echostr) throws Exception {
        log.info("wechat auth start");
        log.info(String.format("signature:%s, timestamp:%s, nonce:%s, echostr:%s",
                signature, timestamp, nonce, echostr));

        //如果认证通过，原样返回echostr值，并返回200的response
        if (wechatAuth(signature, timestamp, nonce)) {
            log.info("wechat auth success");
            return new ResponseEntity<String>(echostr, HttpStatus.OK);
        }

        //如果失败，则返回400，并提示认证失败
        log.info("wechat auth failed");
        return new ResponseEntity<String>("wechat auth failed.", HttpStatus.BAD_REQUEST);
    }

    private boolean wechatAuth(String signature, String timestamp, String nonce) {
    	//将这3个string放到一个list里
        ArrayList<String> strings = Lists.newArrayList(token, timestamp, nonce);
        log.info(String.format("before sort array:%s", strings));
        //按字母顺序做一下排序
        Collections.sort(strings);
        log.info(String.format("after sort array:%s", strings));

        //将list里面所有string组合成一个string，这里用到了guava的Joiner
        String groupString = Joiner.on("").join(strings);
        log.info(String.format("groupString string:%s", groupString));

        //用SHA1加密该string
        String result = sha1(groupString);
        log.info(String.format("sha1:%s", result));
        //加密后的值和signature进行比较，注意用java加密后都是字母都是大写的，而传过来的signature是小写字母，所以要大小写转换一下
        boolean compareResult = result.equals(signature.toUpperCase());
        log.info(String.format("compare result:%b", compareResult));
        return compareResult;
    }

    //类似php的sha1方法
    private String sha1(String s) {
        try {
            // Create MD5 Hash
            MessageDigest digest = MessageDigest.getInstance("SHA-1");
            digest.update(s.getBytes());
            byte messageDigest[] = digest.digest();

            // Create Hex String
            StringBuilder hexString = new StringBuilder();
            for (byte aMessageDigest : messageDigest) {
                hexString.append(String.format("%02X", 0xFF & aMessageDigest));
            }
            return hexString.toString();
        } catch (Exception e) {
            throw new RuntimeException("sha1 failed");
        }
    }
}