我看了下demo中是这样的

String signature = request.getParameter("signature");

String nonce = request.getParameter("nonce");

String timestamp = request.getParameter("timestamp");

...

WxMpXmlMessage inMessage = WxMpXmlMessage.fromEncryptedXml(

request.getInputStream(), this.configStorage, timestamp, nonce,

msgSignature);

我们项目上的

public static void handleCallbackMessage(

HttpServletRequest req, HttpServletResponse resp, MpAppCallbackMessageHandler[] handlers) throws IOException{

String msgSignature = req.getParameter("signature");

String timestamp = req.getParameter("timestamp");

String nonce = req.getParameter("nonce");

String echostr = req.getParameter("echostr");

log.info("进入回调信息处理: signature={}, timestamp={}, nonce={}, echostr={}",

msgSignature, timestamp, nonce, echostr);

String respTxt;

if (StringUtils.isNotBlank(echostr)){

respTxt = callbackAppValidate(req, msgSignature, timestamp, nonce, echostr);

}else{

InputStream in = req.getInputStream();

if (null==handlers){

handlers = new MpAppCallbackMessageHandler[]{};

}

respTxt = callbackAppMessageHandle(req, msgSignature, timestamp, nonce, in, handlers);

}

resp.getWriter().println(respTxt);

log.info("回调处理完成: "+respTxt);

}

private static String callbackAppMessageHandle(HttpServletRequest req, String msgSignature, String timestamp,

String nonce, InputStream inputStream, MpAppCallbackMessageHandler[] handlers) throws IOException {

if (handlers.length <= 0) {

return "";

}

WxMpConfigStorage config = getWxMpConfig(req);

WxMpService wxMpService = getWxMpService(req);

WxMpMessageRouter wxMpMessageRouter = new WxMpMessageRouter(wxMpService);

WxMpMessageRouterRule rule = null;

for (int i = 0; i < handlers.length; i++) {

MpAppCallbackMessageHandler h = handlers[i];

if (null == rule) {

rule = wxMpMessageRouter.rule();

}

h.defineHandler(rule, config);

rule = rule.end().rule();

}

String encryptType = StringUtils.isBlank(req.getParameter("encrypt_type"))

? "raw"

: req.getParameter("encrypt_type");

WxMpXmlMessage inMessage = null;

if ("raw".equals(encryptType)) {

inMessage = WxMpXmlMessage.fromEncryptedXml(inputStream, config, timestamp, nonce, msgSignature);

} else if ("aes".equals(encryptType)) {

inMessage = WxMpXmlMessage.fromXml(inputStream);

}

if(null == inMessage){

throw new RuntimeException("加密模式["+encryptType+"]不支持!");

}

log.info("Income message: " + inMessage);

WxMpXmlOutMessage outMessage = wxMpMessageRouter.route(inMessage);

if (outMessage != null) {

if ("raw".equals(encryptType)) {

return outMessage.toEncryptedXml(config);

} else if ("aes".equals(encryptType)) {

return outMessage.toXml();

}else{

return "";

}

} else {

return "";

}

}

用得都是me.chanjar.weixin.mp.bean.message.WxMpXmlMessage.fromEncryptedXml(InputStream, WxMpConfigStorage, String, String, String)

然后问题就出在,从微信端拿到的msgSignature,从结算结果来看,应该是

SHA1.gen(this.token, timeStamp, nonce)的结果，而不是 SHA1.gen(this.token, timeStamp, nonce, cipherText)