WeChat public platform development: message encryption

Not long ago, the enterprise account used the mandatory message encryption method, and then the public account added the optional message encryption option. Currently, enterprise numbers and public numbers are encrypted in the same way (the format is slightly different ). Not long ago, the enterprise account used the mandatory message encryption method, and then the public account added the optional message encryption option. Currently, enterprise numbers and public numbers are encrypted in the same way (the format is slightly different ).

Encryption Settings

Go to the "Developer Center" in the public account background, and we can see the Url docking settings:

There are three encryption methods:

Plaintext mode, that is, the original message format

Compatible Mode. plaintext and ciphertext will coexist. officially released products are not recommended (because they still contain plaintext and cannot achieve the encryption effect)

Security mode. In this mode, messages are encrypted. the developer's server can decrypt the messages by using an official algorithm to obtain the original message in plaintext mode.

The returned information of encrypted messages must also be encrypted.

Process encrypted information

Senparc. Weixin. MP has automatically determined the three types of messages. during the development process, you do not need to pay attention to any decryption and encryption processes, but still need to keep the development process in "plaintext mode.

In the corresponding MessageHandler, we can know the current encryption status through some parameters:

MessageHandler. UsingEcryptMessage: whether encrypted information is used (including compatibility mode and security mode)

MessageHandler. UsingCompatibilityModelEcryptMessage: whether the compatibility mode is used to encrypt information

Through the combination of the above two attributes, we can know which encryption mode the current account uses (of course, in most cases, developers do not need to care about ).

To better track information, MessageHandler adds the FinalResponseDocument attribute:

MessageHandler. ResponseDocument: XML object of response data in plaintext structure

MessageHandler. FinalResponseDocument: the XML object that will be returned to the server. it will be consistent with ResponseDocument without encryption; otherwise, it will be automatically encrypted.

Encryption principle

The encryption algorithm (including sample downloads in several languages) can be found in the official help documentation: http://mp.weixin.qq.com/wiki/index.php? Title = % E6 % 8A % 80% E6 % 9C % AF % E6 % 96% B9 % E6 % A1 % 88

Here we will explain the EncodingAESKey, which is a bit difficult to explain. In fact, EncodingAESKey is a Base64 encoding of AESKey, and AESKey is a 32-length random string (from a-z, A-Z, 0-9 ). Because the 32-character Base64 encoding length is fixed to 44 (the last character is =), after removing =, an EncodingAESKey with the final length of 43 characters is generated. EncodingAESKey is used in message encryption and decryption, and must be kept strictly confidential.

Below is a piece of C # code for generating EncodingAESKey:

Protected string CreateEncodingAESKey () {string aesKey = GetRadomStr (32); // Obtain a-z, A-Z, 0-9 random string var encodingAesKey = Convert. toBase64String (Encoding. UTF8.GetBytes (aesKey), Base64FormattingOptions. none); return encodingAesKey. substring (0, encodingAesKey. length-1 );}

For more public platform development: For more information about message encryption, see PHP!