/**
 * 微信消息接收和token驗證
 * @param model
 * @param request
 * @param response
 * @throws IOException
 */
 @RequestMapping("/ownerCheck")
 public void ownerCheck(Model model, HttpServletRequest request,HttpServletResponse response) throws IOException {
 System.out.println(111);
 boolean isGet = request.getMethod().toLowerCase().equals("get");
 PrintWriter print;
 if (isGet) {
  // 微信加密簽名
  String signature = request.getParameter("signature");
  // 時間戳
  String timestamp = request.getParameter("timestamp");
  // 隨機數
  String nonce = request.getParameter("nonce");
  // 隨機字符串
  String echostr = request.getParameter("echostr");
  // 通過檢驗signature對請求進行校驗，若校驗成功則原樣返回echostr，表示接入成功，否則接入失敗
  if (signature != null && CheckoutUtil.checkSignature(signature, timestamp, nonce)) {
  try {
   print = response.getWriter();
   print.write(echostr);
   print.flush();
  } catch (IOException e) {
   e.printStackTrace();
  }
  }
 }
 }

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class CheckoutUtil {
 // 與接口配置信息中的Token要一致
 private static String token = "handsomeKing";

 /**
 * 驗證簽名
 * 
 * @param signature
 * @param timestamp
 * @param nonce
 * @return
 */
 public static boolean checkSignature(String signature, String timestamp, String nonce) {
 String[] arr = new String[] { token, timestamp, nonce };
 // 將token、timestamp、nonce三個參數進行字典序排序
 // Arrays.sort(arr);
 sort(arr);
 StringBuilder content = new StringBuilder();
 for (int i = 0; i < arr.length; i++) {
  content.append(arr[i]);
 }
 MessageDigest md = null;
 String tmpStr = null;

 try {
  md = MessageDigest.getInstance("SHA-1");
  // 將三個參數字符串拼接成一個字符串進行sha1加密
  byte[] digest = md.digest(content.toString().getBytes());
  tmpStr = byteToStr(digest);
 } catch (NoSuchAlgorithmException e) {
  e.printStackTrace();
 }
 content = null;
 // 將sha1加密后的字符串可與signature對比，標識該請求來源于微信
 return tmpStr != null ? tmpStr.equals(signature.toUpperCase()) : false;
 }

 /**
 * 將字節數組轉換為十六進制字符串
 * 
 * @param byteArray
 * @return
 */
 private static String byteToStr(byte[] byteArray) {
 String strDigest = "";
 for (int i = 0; i < byteArray.length; i++) {
  strDigest += byteToHexStr(byteArray[i]);
 }
 return strDigest;
 }

 /**
 * 將字節轉換為十六進制字符串
 * 
 * @param mByte
 * @return
 */
 private static String byteToHexStr(byte mByte) {
 char[] Digit = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
 char[] tempArr = new char[2];
 tempArr[0] = Digit[(mByte >>> 4) & 0X0F];
 tempArr[1] = Digit[mByte & 0X0F];
 String s = new String(tempArr);
 return s;
 }
 public static void sort(String a[]) {
 for (int i = 0; i < a.length - 1; i++) {
  for (int j = i + 1; j < a.length; j++) {
  if (a[j].compareTo(a[i]) < 0) {
   String temp = a[i];
   a[i] = a[j];
   a[j] = temp;
  }
  }
 }
 }
}

/**
 * 第一步：用戶同意授權，獲取code(引導關注者打開如下頁面：)
 * 獲取 code、state
 */
 public static String getStartURLToGetCode() {
 
 String takenUrl = "https://open.weixin.qq.com/connect/oauth3/authorize?appid=APPID&redirect_uri=REDIRECT_URI&response_type=code&scope=SCOPE&state=STATE#wechat_redirect";
 takenUrl= takenUrl.replace("APPID", Param.APPID);
 takenUrl= takenUrl.replace("REDIRECT_URI", URL.encode(Param.REDIRECT_URI));
 //FIXME ： snsapi_userinfo
 takenUrl= takenUrl.replace("SCOPE", "snsapi_userinfo");
 System.out.println(takenUrl);
 return takenUrl;
 }

/**
 * 獲取access_token、openid
 * 第二步：通過code獲取access_token
 * @param code url = "https://api.weixin.qq.com/sns/oauth3/access_token
 *   ?appid=APPID
 *   &secret=SECRET
 *   &code=CODE
 *   &grant_type=authorization_code"
 * */
 public static OAuthInfo getAccess_token(String code){
 
 
 String authUrl = "https://api.weixin.qq.com/sns/oauth3/access_token?appid=APPID&secret=SECRET&code=CODE&grant_type=authorization_code ";
 authUrl= authUrl.replace("APPID", Param.APPID);
 authUrl = authUrl.replace("SECRET", Param.SECRET);
 authUrl = authUrl.replace("CODE", code);
 String jsonString = HTTPRequestUtil.sendPost(authUrl,"");
 System.out.println("jsonString: " + jsonString);
 OAuthInfo auth = null;
 try {
  auth = (OAuthInfo) JacksonUtil.parseJSONToObject(OAuthInfo.class, jsonString);
 } catch (Exception e) {
  e.printStackTrace();
 }
 return auth;
 }

/**
 * 微信引導頁進入的方法
 * @return
 */
 @RequestMapping("/loginByWeiXin")
 public String loginByWeiXin(HttpServletRequest request, Map<String, Object> map) {
 // 微信接口自帶 2 個參數
 String code = request.getParameter("code");
 String state = request.getParameter("state");
 System.out.println("code = " + code + ", state = " + state);
 
 if(code != null && !"".equals(code)) {
  // 授權成功, 微信獲取用戶openID
  OAuthInfo authInfo = WeiXinUtil.getAccess_token(code);
  String openid = authInfo.getOpenid();
  String access_token = authInfo.getAccess_token();
  
  if(access_token == null) {
  // Code 使用過 異常
  System.out.println("Code 使用過 異常.....");
  return "redirect:" + WeiXinUtil.getStartURLToGetCode();
  }
  
  // 數據庫中查詢微信號是否綁定平臺賬號
  SysUser sysUser = weiXinService.getUserByWeiXinID(openid);
  if(sysUser == null) {
  String randomStr = StringUtil.getRandomString(50);
  request.getSession().setAttribute(openid, randomStr);
  // 尚未綁定賬號
  System.out.println("尚未綁定賬號.....");
  return "redirect:/index.jsp?openid=" + openid + "&state=" + randomStr;
  }
  userController.doSomeLoginWorkToHomePage(sysUser.getMcid(), map);
  // 登錄成功
  return "homePage";
 } 
 // 未授權
 return "redirect:" + WeiXinUtil.getStartURLToGetCode();
 
 }