google play 支付签名验证

崔哥

发布于 2022-09-07 06:02:57

2.3K00

代码可运行

文章被收录于专栏：崔哥的专栏崔哥的专栏

运行总次数：0

代码可运行

app端支付成功会有一个Purchase对象，里面有购买令牌(purchaseToken)和其他参数，如下

JSONObject jsonObject=new JSONObject();
try {
    jsonObject.put("packageName", purchase.getPackageName());
    jsonObject.put("purchaseToken", purchase.getPurchaseToken());
    jsonObject.put("signature", purchase.getSignature());
    jsonObject.put("purchaseTime", purchase.getPurchaseTime());
    jsonObject.put("purchaseState", purchase.getPurchaseState());
    jsonObject.put("developerPayload", purchase.getDeveloperPayload());
//  jsonObject.put("accountIdentifiers", purchase.getAccountIdentifiers());
    jsonObject.put("orderId", purchase.getOrderId());
    jsonObject.put("originalJson", purchase.getOriginalJson());
    jsonObject.put("products", StringUtils.join(purchase.getProducts(), ","));
    jsonObject.put("quantity", purchase.getQuantity());
    jsonObject.put("isAutoRenewing", purchase.isAutoRenewing());
    jsonObject.put("isAcknowledged", purchase.isAcknowledged());
    Log.e("TAG", jsonObject.toString());
} catch (JSONException e) {
    e.printStackTrace();
}

得到的json，如下

{
    "packageName": "net.cuiwei.voice",
    "purchaseToken": "mjnmdjeccbcmeagmnfieahnd.AO-J1Oza5K7ZQVA。。",
    "signature": "BjEqq1T4NYMlIC\/SXXNgtX2UQRBh0kN。。",
    "purchaseTime": 1657271487378,
    "purchaseState": 1,
    "developerPayload": "",
    "orderId": "GPA.3349-0595-6867-76089",
    "originalJson": "{\"orderId\":\"GPA.3349-0595-6867-76089\",\"packageName\":\"net.cuiwei.voice\",\"productId\":\"voice_0\",\"purchaseTime\":1657271487378,\"purchaseState\":0,\"purchaseToken\":\"mjnmdjeccbcmeagmnfieahnd.AO-J1Oza5K7ZQVA。。",\"quantity\":1,\"acknowledged\":false}",
    "products": "voice_0",
    "quantity": 1,
    "isAutoRenewing": false,
    "isAcknowledged": false
}

建议这些参数都上传给服务器。

作为服务端，我们知道客户端传过来的数据是可以伪造的，那么我们需要有一个验证签名的步骤

验证签名

验证签名需要三个参数

originalJson
signature
google公钥

如上图可以取得Google公钥

下面是PHP代码

echo googlePayVerify('original_json...', 'signature...', 'google_public_key...').PHP_EOL;

/**
 * 谷歌支付签名验证
 * @param string $original_json
 * @param string $signature
 * @param string $google_public_key
 * @return bool
 */
function googlePayVerify(string $original_json, string $signature, string $google_public_key):bool {
    $public_key_handle = openssl_pkey_get_public($google_public_key);
    if($public_key_handle===false){
        $public_key = "-----BEGIN PUBLIC KEY-----" . PHP_EOL .
            chunk_split($google_public_key, 64, PHP_EOL) .
            "-----END PUBLIC KEY-----";
        $public_key_handle = openssl_pkey_get_public($public_key);
        if($public_key_handle===false) return false;
    }
    $result = openssl_verify($original_json, base64_decode($signature), $public_key_handle, OPENSSL_ALGO_SHA1);
    openssl_free_key($public_key_handle);
    return $result;
}