package com.aixunma.validation;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
 * 用来请求微信服务器请求验证
 * <p>类的描述:</p>
 * <p>@Description: TODO</p>
 * <p>@author 小海</p>
 * <p>@time:2017年4月27日 下午10:14:10</p>
 * <p>@Vesion: 1.0</p>
 */
public class ValidationServlet extends HttpServlet{

    /**
     * 
     */
    private static final long serialVersionUID = 1L;

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        
        response.setCharacterEncoding("UTF-8"); // 设置编码
        
        /*
         *获取微信服务器往自己的服务器的请求参数中传递的4个参数 
         */
        
        // 签名之字符串
        final String signature = request.getParameter("signature");
        
        // 时间戳
        final String timestamp = request.getParameter("timestamp");
        
        // 随机数
        final String nonce = request.getParameter("nonce");
        
        // 随机字符串
        final String echostr = request.getParameter("echostr");
        
        StringBuilder builder = new StringBuilder();
        builder.append("签名之字符串:").append(signature)
            .append("\n")
            .append("时间戳:").append(timestamp)
            .append("\n")
            .append("随机数").append(nonce)
            .append("\n")
            .append("随机字符串").append(echostr)
            .append("\n").append("-------------------------");
        // 输出
        System.out.println(builder.toString());
        
        // 验证:调用工具类
        final boolean result = ValidationTool.checkSignature(signature, timestamp, nonce);
        // 输出
        final PrintWriter writer = response.getWriter();
        if (result == true) {
            // 校验成功后返回原样echostr
            writer.println(echostr);
        }
        
        writer.close();
    }
    
}

package com.aixunma.validation;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;

/**
 * 微信服务器校验工具类
 * <p>类的描述:</p>
 * <p>@Description: TODO</p>
 * <p>@author 小海</p>
 * <p>@time:2017年4月27日 下午10:32:26</p>
 * <p>@Vesion: 1.0</p>
 */
public class ValidationTool {
    
    // 声明一个TOKEN：必须要与微信公众号后台基本配置的的Token保持一致
    private static final String TOKEN = "aixunma";
    
    @SuppressWarnings("static-access")
    public static boolean checkSignature(String signature, String timestamp, String nonce) {
        
        // 1、将token、timestamp、nonce三个参数进行字典序排序:先保存在数组中，再实现字典顺序排序
        final String[] params = new String[] {TOKEN, timestamp, nonce};
        Arrays.sort(params);
        
        // 2、将三个参数字符串拼接成一个字符串进行sha1加密
        final StringBuilder builder = new StringBuilder();
        for (int i = 0; i < params.length; i++) {
            builder.append(params[i]);
        }
        MessageDigest digest = null;
        String result = "";
        try {
            // 进行sha1加密
            digest = digest.getInstance("SHA-1");
            byte[] byteArray = digest.digest(builder.toString().getBytes());
            
            // 将加密后的密文字节数组转换成为密文字符串
            result = byteArrayToStr(byteArray);
            System.out.println("加密后的密文是:" + result);
        } catch (NoSuchAlgorithmException e) {
            System.out.println("加密失败");
            e.printStackTrace();
        } finally {
            if (digest != null) {
                try {
                    digest.clone();
                } catch (CloneNotSupportedException e) {
                    // 不做处理
                }
            }
        }
        // 3、将加密后的字符串与微信服务器接受的原始signature签名字符串进行对比，
        // 如果对比相等说明标识该请求来源微信服务器，否则不是来之微信服务器，请求验证不通过
        return result != null ? result.equals(signature.toUpperCase()) : false;
    }
    
    
    /**
     * 将一个字节数组转换成字符串
     * @param byteArray 字节数组
     * @return
     */
    private static String byteArrayToStr(byte[] byteArray) {

        final StringBuilder strDigest = new StringBuilder();
        for (int i = 0; i < byteArray.length; i++) {
            strDigest.append(byteToHexStr(byteArray[i]));
        }
        
        return strDigest.toString();
    }
    
    /**
     * 将一个字节转换为十六进制的字符串
     * @param byteDate 一个字节
     * @return
     */
    private static String byteToHexStr(byte byteDate) {
        
        char[] digit = {‘0‘,‘1‘,‘2‘,‘3‘,‘4‘,‘5‘,‘6‘,‘7‘,‘8‘,‘9‘,‘A‘,‘B‘,‘C‘,‘D‘,‘E‘,‘F‘};
        char[] temp = new char[2];
        temp[0] = digit[(byteDate >>> 4) & 0X0F];
        temp[1] = digit[byteDate & 0X0F];
        
        final String str = new String(temp);
        return str;
    }
}

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0">
  <display-name>WechatValidation</display-name>
  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
  <servlet>
    <servlet-name>validation</servlet-name>
    <servlet-class>com.aixunma.validation.ValidationServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>validation</servlet-name>
    <url-pattern>/validation.html</url-pattern>
  </servlet-mapping>
</web-app>