Alipay mobile web payment and wechat public account payment access

The first step: Go to Alipay to create a sandbox application and apply for opening the corresponding permission, which is the test environment. After the completion of the go to https://auth.alipay.com/login/ant_sso_index.htm?goto=https%3A%2F%2Fopenhome.alipay.com%2Fplatform%2FappDaily.htm%3Ft Ab %3Dinfo check your application, in which there will be APPID, Alipay gateway and other parameters, key and alipay public key can be generated as prompted, these parameters will be used in the code after.

Step 2: The code part of your own server. Before writing the code, import the SDK prepared by Ma Dad. Maven depends on the following.

< the dependency > < groupId > com. Alipay. The SDK < / groupId > < artifactId > alipay - SDK - Java < / artifactId > < version > 3.4.27. ALL < / version > </dependency>Copy the code

Then we need to know what the payment process is. According to the general logic, the front end takes the order ID and requests the unified ordering interface of the background. The interface sorts out the data and returns the information to the front end, and the front end requests Alipay to start the payment with the information. After the payment is completed, the front end redirects to the front page for synchronous notification according to the return_URL, and invoics the back-end interface of the server for asynchronous notification according to the notifY_URL.

Let’s get down to business:

Unified order interface: start from here is the first step in the payment process, organize data to the front to initiate payment requests, the interface parameters can refer to the official document should be https://docs.open.alipay.com/api (this is all the API documentation, find themselves need to interface). Note that return_URL and notifY_URL, return_URL: synchronous jump path, is the path of the front-end jump page after the payment is complete, usually the path of an HTML page. This jump only indicates that the payment is complete, meaning that the whole payment process is complete, not the success or failure of the payment. Notify_url is an asynchronous notification, usually a requestMapping of the back-end controller. This is the interface that really notifies the payment success or failure. The back-end needs to write an interface that accepts the information returned by Alipay. The unified order interface returns different information depending on the type of request. GET requests return JSON or XML, and POST directly returns a form with the order information. The front end can request payment after receiving the information returned by the unified single interface.

 public void alipay(UserEntity userEntity, HttpServletResponse response, Long id) {

Try {// Obtain the order information from the database according to the order ID to request the alipay interface data encapsulation (here it is best to pass the current login user together with SQL query, BookingOrderEntity BookingOrderEntity = UserDao.getorderDetail (userEntity.getid (), ID); / / encapsulation public parameters AlipayClient AlipayClient = new DefaultAlipayClient (alipayConfig. GetGatewayUrl (), alipayConfig. GetAppId (), alipayConfig.getMerchantPrivateKey(),"json", AlipayConfig.charset, alipayConfig.getAlipayPublicKey(), AlipayConfig.signType); AlipayTradeWapPayRequest alipayRequest = new AlipayTradeWapPayRequest(); AlipayTradeWapPayRequest(); / / synchronization rebound in public parameters set in the front page and back asynchronous notification path alipayRequest. SetReturnUrl (alipayConfig. GetReturnUrl (.) replace ("ID", bookingOrderEntity.getId().toString())); alipayRequest.setNotifyUrl(alipayConfig.getNotifyUrl()); / / fill business parameters, namely, the order information String subject = bookingOrderEntity. GetSnapshotHotelName () +"-" + bookingOrderEntity.getBookingNo();
    alipayRequest.setBizContent("{" +
        " \"out_trade_no\":" + bookingOrderEntity.getBookingNo() + "," +
        " \"total_amount\":" + bookingOrderEntity.getPayPrice() + "," +
        " \"subject\":\"" + subject + "\"," +
        " \"product_code\":\"QUICK_WAP_WAY\"" +
        "}"); String form = AlipayClient.pageExecute (alipayRequest).getBody(); response.setContentType("text/html; charset=utf-8"); Response.getwriter ().write(form); } catch (AlipayApiException e) { e.printStackTrace(); } catch (IOException e) { e.printStackTrace(); }}Copy the code

Alipay parameters entity class: I am written to the configuration file to take information, you can also be directly written as ordinary class parameters on the line.

@Component
@ConfigurationProperties(prefix = "alipay") public class AlipayConfig {/** * APPID, payid, payid */ @value ("${alipay.appId}") private String appId; /** * merchant private key, your PKCS8 format RSA2 private key */ @value ("${alipay.merchantPrivateKey}") private String merchantPrivateKey; / * * * alipay public key, check the address: https://openhome.alipay.com/platform/keyManage.htm under the corresponding APPID alipay public key. */ @Value("${alipay.alipayPublicKey}") private String alipayPublicKey; /** * The path of the server asynchronous notification page must be in the format of http://. */ @value (id=123)"${alipay.notifyUrl}") private String notifyUrl; /** * The path of the synchronization notification page is in the format of http://and cannot be added with? */ @value (id=123)"${alipay.return_url}")
  private String returnUrl; /** * @value ("${alipay.gatewayUrl}") private String gatewayUrl; /** * signType */ public static String signType ="RSA2"; Public static String charset ="utf-8";


  public String getAppId() {
    return appId;
  }

  public String getMerchantPrivateKey() {
    return merchantPrivateKey;
  }

  public String getAlipayPublicKey() {
    return alipayPublicKey;
  }

  public String getNotifyUrl() {
    return notifyUrl;
  }

  public String getReturnUrl() {
    return returnUrl;
  }

  public String getGatewayUrl() {
    return gatewayUrl;
  }

  public void setAppId(String appId) {
    this.appId = appId;
  }

  public void setMerchantPrivateKey(String merchantPrivateKey) {
    this.merchantPrivateKey = merchantPrivateKey;
  }

  public void setAlipayPublicKey(String alipayPublicKey) {
    this.alipayPublicKey = alipayPublicKey;
  }

  public void setNotifyUrl(String notifyUrl) {
    this.notifyUrl = notifyUrl;
  }

  public void setReturnUrl(String returnUrl) {
    this.returnUrl = returnUrl;
  }

  public void setGatewayUrl(String gatewayUrl) { this.gatewayUrl = gatewayUrl; }}Copy the code

POST is an auto-submitted form that can be loaded directly from the front end.

Nail internal penetration: Return_url notify_url and must be able to access to the outside web, if want to test locally, you can download a nailing Intranet through tool https://open-doc.dingtalk.com/microapp/debug/ucof2g, Here is an example of how to use Mac, Windows operation: CD to git clone directory, MAC and Windows two versions, Windows access, do not need to chmode command, this command is used to change the permission, start the command to ding-config = ding.cfg-subdomain =a 8080.

Open the penetration tool: as shown below, a is the domain prefix, which can be customized, and 8081 is the port of your local backend server.

To success: the diagram below, this as if can only use HTTP cannot use HTTPS, open after the success only need to change the notify_url to: http://a.vaiwan.com:8081/xxx/xxx.

Payment callback interface: The mechanism of Alipay is to call back after the payment is completed, and stop calling after receiving the return of SUCCESS from our server, and the whole payment process is completed. If SUCCESS we returned to Alipay is not received after 15 seconds (I don’t remember this data, please check the official document), the call will continue, and the time interval will gradually increase.

Therefore, the first step is to check whether this information has been processed in our database according to the order number returned by Alipay, because this situation may occur: Assuming that the callback interval is 15 seconds, we returned SUCCESS to Alipay at the 14th second. However, due to network reasons, Alipay did not receive our information at the 15th second, so it still responded to us. However, in fact, we had already processed the order information at the 14th second, but Alipay did not know. Therefore, if the order has been processed, no matter the payment is successful or failed, directly return SUCCESS to Alipay to tell it that Ben’s dad has known about it and back off.

The second step is to check the check. The information returned by Alipay is directly retrieved from the request. If the verification fails, it may be a malicious attack from other servers. Then return failure to Alipay. Judge APPID, payment amount, alipay to give me the success mark, etc., modify the order information payment success or failure.

  public void notify(HttpServletRequest request, HttpServletResponse response) {

Map<String, String> params = new HashMap<>(30); Map requestParams = request.getParameterMap();for (Iterator iter = requestParams.keySet().iterator(); iter.hasNext(); ) {
      String name = (String) iter.next();
      String[] values = (String[]) requestParams.get(name);
      String valueStr = "";
      for (int i = 0; i < values.length; i++) {
        valueStr = (i == values.length - 1) ? valueStr + values[i]
            : valueStr + values[i] + ","; } params.put(name, valueStr); String outTradeNo = new String(request.getParameter())"out_trade_no").getBytes("ISO-8859-1"), "UTF-8"); String tradeNo = new String(request.getParameter())"trade_no").getBytes("ISO-8859-1"), "UTF-8"); String totalAmount = new String(request.getParameter())"total_amount").getBytes("ISO-8859-1"), "UTF-8"); TradeStatus = new String(request.getParameter())"trade_status").getBytes("ISO-8859-1"), "UTF-8");
    // APPID
    String appId = new String(request.getParameter("app_id").getBytes("ISO-8859-1"), "UTF-8"); // Remember that AlipayPublicKey is the publickey of Alipay, please go to open.alipay.com corresponding application to check. boolean signVerified = AlipaySignature.rsaCheckV1(params, alipayConfig.getAlipayPublicKey(), AlipayConfig.charset, AlipayConfig.signType); Boolean isPaysuccess = payDao.getPayStatus(outTradeNo);if(isPaysuccess ! = null) { response.getWriter().write("success");
    } else{// Business processingifBigDecimal payPrice = Paydao.getPayPrice (outTradeNo); // Trade success status in normal instant receipt status String normalTradeStatus ="TRADE_FINISHED"; // Advanced Instant To Account easy success status String advancedTradeStatus ="TRADE_SUCCESS"; // Payment amount, order completion identifier, AppID Validation Boolean priceFlag = new BigDecimal(totalAmount). CompareTo (payPrice) == 0; Boolean tradeFlag = normalTradeStatus.equals(tradeStatus) || advancedTradeStatus.equals(tradeStatus); Boolean appidFlag = alipayConfig.getAppId().equals(appId);if(priceFlag && tradeFlag && appidFlag) {/ / change the order status to reserve (success) in payDao. UpdateOrderStateByNo (outTradeNo, BookingConst.STATE_BOOKING.getCode(), CommonConstant.ALIPAY, CommonConstant.PAYSUCCESS); response.getWriter().write("success");
        } else{/ / change the order status to pay failure payDao updateOrderStateByNo (outTradeNo, BookingConst. STATE_ORDER_PAY_FAIL. GetCode (), CommonConstant.ALIPAY, CommonConstant.PAYFAIL); response.getWriter().write("success"); }}else {
        response.getWriter().write("failure"); } } } catch (AlipayApiException e) { e.printStackTrace(); } catch (IOException e) { e.printStackTrace(); }}Copy the code

First of all, wechat does not have the same sandbox environment as Alipay and can only be directly written in the real environment. The process is still the same: the front end takes the order ID to request the background to place a unified order interface; the back end sorts out all kinds of data and returns to the front end. The front end takes these data to request wechat Pay. Wechat Pay does not have return_url, and the front end writes the callback function by itself.

Here emphasis: wechat pay callback can only use port 80!!

Here emphasis: wechat pay callback can only use port 80!!

Here emphasis: wechat pay callback can only use port 80!!

By pit vomited blood to have ？？？？？？

Unified ordering interface: openId and so on can be based on their own projects, I have stored in the database, other points need to pay attention to I have annotated. It can be divided into two parts: The first part, through the order information and public parameters to get the prepayment ID prepay_id. Part two: Regenerating the signature back to the front end by putting this parameter together with other partial parameters.

public Map<Object, Object> wechatPay(HttpServletRequest request, HttpServletResponse response, Long userId, Long id) { SortedMap<Object, Object> param = new TreeMap<>(); Openid = userdao.geTopenId (userId); // Obtain openID from the database. BookingOrderEntity BookingOrderEntity = UserDao.getorderDetail (userId, ID); SortedMap<Object, Object> packageParams = new TreeMap<Object, Object>(); packageParams.put("appid", wechatPayConfig.getAppId());
    packageParams.put("mch_id", wechatPayConfig.getMchId()); Packageparams.put (packageparams.put (packageparams.put ("nonce_str", RandomUtil.generateStr(32));
    packageParams.put("out_trade_no", bookingOrderEntity.getBookingNo());
    packageParams.put("openid", openid); // wechat API requires the incoming amount in minutes packageparams.put ("total_fee", bookingOrderEntity.getPayPrice().setScale(2, RoundingMode.HALF_UP).multiply(new BigDecimal(100)).stripTrailingZeros().toPlainString());
    packageParams.put("spbill_create_ip", HttpUtil.getRealIp(request));
    packageParams.put("notify_url", wechatPayConfig.getNotifyUrl());
    packageParams.put("trade_type", wechatPayConfig.getTradeType());
    packageParams.put("body", wechatPayConfig.getBody()); String sign = payCommonUtil.createsign (String sign = payCommonUtil.createsign ("UTF-8", packageParams, wechatPayConfig.getAppKey());
    packageParams.put("sign", sign); String requestXML = PayCommonUtil.getRequestXml(packageParams); / / request unified order interface (mainly to obtain prepay_id this parameter) String resXml = HttpUtil. PostData (wechatPayConfig. GetUfdorUrl (), requestXML, null); Map<String, Object> map = XmlUtil.doXMLParse(resXml); // Determine the request result ifreturnIf Code and resultCode are both SUCCESS, the signature is re-generated according to the new parameters and returned to the front end for the front end to request payment interface String mark ="SUCCESS";
    String returnCode = "return_code";
    String resultCode = "result_code";
    if (mark.equals(map.get(returnCode)) && mark.equals(map.get(resultCode))) {
      param.put("appId", wechatPayConfig.getAppId());
      param.put("nonceStr", RandomUtil.generateStr(32));
      param.put("package"."prepay_id=" + map.get("prepay_id"));
      param.put("signType"."Md5");
      param.put("timeStamp", String.valueOf(System.currentTimeMillis() / 1000)); // Generate a new signature with new parameters String paySign = payCommonUtil.createsign ("UTF-8", param, wechatPayConfig.getAppKey());
      param.put("paySign", paySign);
    } else {
      throw new SzException("Unified order error!");
    }
  } catch (JDOMException e) {
    e.printStackTrace();
  } catch (IOException e) {
    e.printStackTrace();
  }
  return param;
}Copy the code