微信支付: API V3支付回调签名验证

 // 平台证书序列号
string serialNo = Request.Headers.GetValues("Wechatpay-Serial").FirstOrDefault();

// 签名时间戳
string timestamp = Request.Headers.GetValues("Wechatpay-Timestamp").FirstOrDefault();

// 签名随机字符串
string nonce = Request.Headers.GetValues("Wechatpay-Nonce").FirstOrDefault();

// 验签值
string signature = Request.Headers.GetValues("Wechatpay-Signature").FirstOrDefault();

Request.Content.ReadAsStreamAsync().Result.Seek(0, System.IO.SeekOrigin.Begin);
// POST请求主体
string body = Request.Content.ReadAsStringAsync().Result;

string message = $"{timestamp}\n{nonce}\n{body}\n";

public class WXCertHelper
{
    List<WXPlatformPublicKey> CacheData { get; set; }

    private WXCertHelper()
    {
        CacheData = new List<WXPlatformPublicKey>();
    }

    static WXCertHelper _intance;

    // 单例模式
    public static WXCertHelper Intance
    {
        get
        {
            if (_intance == null)
            {
                _intance = new WXCertHelper();
                _intance.LoadCacheData();
            }
            return _intance;
        }
    }

    /// <summary>
    /// 从本地加载平台序列号
    /// </summary>
    void LoadCacheData()
    {
        CacheData.Clear();
        // 从数据库加载数据
    }
    /// <summary>
    /// 保存平台公钥到本地
    /// </summary>
    /// <param name="data"></param>
    void SaveCacheData()
    {
        //List<WXPlatformPublicKey> data = this.CacheData;
        // 刷新本地存储
    }

    public string GetPublicKey(string serialNo)
    {
        // 匹配缓存中的公钥
        var obj = CacheData.Find(w => w.serialNo == serialNo);
        if (obj != null)
        {
            return obj.PublicKey;
        }
        // 缓存中没有，重新下载
        else
        {
            this.RefreshDownCert();
            return GetPublicKey(serialNo);
        }
    }

    /// <summary>
    /// 重新从API下载平台公钥
    /// </summary>
    void RefreshDownCert()
    {
        APIHelper apiHelper = new APIHelper();

        CacheData.Clear();
        var result = apiHelper.DownCert();
        foreach (var o in result.data)
        {
            string publicKey = AesGcm.AesGcmDecrypt(o.encrypt_certificate.associated_data, o.encrypt_certificate.nonce, o.encrypt_certificate.ciphertext, ConfigData.Intance.WXPaySetting.wx_aes_key);
            CacheData.Add(new WXPlatformPublicKey()
            {
                serialNo = o.serial_no,
                PublicKey = publicKey
            });
        }
        SaveCacheData();

    }
}

public class WXPlatformPublicKey
{

    /// <summary>
    /// 平台证书序列号
    /// </summary>
    public string serialNo { get; set; }
    /// <summary>
    /// 平台证书公钥
    /// </summary>
    public string PublicKey { get; set; }
}

/// <summary>
/// 验证签名
/// </summary>
/// <param name="message">签名字符串</param>
/// <param name="publickey">公钥</param>
/// <param name="signStr">签名</param>
/// <returns></returns>
public bool VerifySign(string message, string publickey, string signStr)
{
    try
    {
        var _publicKeyBytes = Encoding.UTF8.GetBytes(publickey);
        var x509 = new X509Certificate2(_publicKeyBytes);
        using (var rsa = (RSACryptoServiceProvider)x509.PublicKey.Key)
        {
            using (var sha256 = new SHA256CryptoServiceProvider())
            {
                var b = rsa.VerifyData(Encoding.UTF8.GetBytes(message), sha256, Convert.FromBase64String(signStr));
                return b;
            }
        }
    }
    catch { return false; }
}

var _publicKeyBytes = Encoding.UTF8.GetBytes(publickey);
var x509 = new X509Certificate2(_publicKeyBytes);
using (var rsa = (System.Security.Cryptography.RSACng)x509.PublicKey.Key)
{
    
    rsa.VerifyData(Encoding.UTF8.GetBytes(message), Convert.FromBase64String(signStr), HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
}