security: 微信回调POST验签——明文模式signature校验防伪造支付回调白拿星尘

2026-09-14 15:50:49 +08:00
parent 7a5dcf8e0e
commit 9ab08254e3
1 changed files with 5 additions and 0 deletions
@@ -38,6 +38,11 @@ module.exports = function registerWxMsgRoutes(app) {

  app.post('/api/wx/msg', async (req, res) => {
    try {
+      // 验签：明文模式下 POST 同样携带 signature/timestamp/nonce，防止伪造支付回调
+      const { signature, timestamp, nonce } = req.query || {}
+      if (!verifySignature(timestamp, nonce, signature)) {
+        return res.status(403).send('forbidden')
+      }
      // 数据格式推荐 JSON：express.json 已解析为对象；选 XML 时是字符串
      let fields = {}
      if (req.body && typeof req.body === 'object') {