security: 微信回调POST验签——明文模式signature校验防伪造支付回调白拿星尘

server/src/routes/wxmsg.js

@@ -38,6 +38,11 @@ module.exports = function registerWxMsgRoutes(app) {
 
   app.post('/api/wx/msg', async (req, res) => {
     try {
+      // 验签：明文模式下 POST 同样携带 signature/timestamp/nonce，防止伪造支付回调
+      const { signature, timestamp, nonce } = req.query || {}
+      if (!verifySignature(timestamp, nonce, signature)) {
+        return res.status(403).send('forbidden')
+      }
       // 数据格式推荐 JSON：express.json 已解析为对象；选 XML 时是字符串
       let fields = {}
       if (req.body && typeof req.body === 'object') {