在 NodeJs 中的支付网关上执行的交易的签名验证

Posted 2023-02-22

【中文标题】在 NodeJs 中的支付网关上执行的交易的签名验证

【英文标题】：Signature Verification of transaction executed on Payment Gateway in NodeJs

【发布时间】：2021-10-20 10:09:51

【问题描述】：

如何在 NodeJs 中实现以下 python/Java/php 代码？ ReferenceLink

Python代码（供参考）：

import hashlib
import hmac
import base64

@app.route('/notify_url/', methods=["POST"])
def notify_url_process():

 postData = 
  "orderId" : request.form['orderId'], 
  "orderAmount" : request.form['orderAmount'], 
  "referenceId" : request.form['referenceId'], 
  "txStatus" : request.form['txStatus'], 
  "paymentMode" : request.form['paymentMode'], 
  "txMsg" : request.form['txMsg'], 
  "txTime" : request.form['txTime'], 
 

 signatureData = postData["orderId"] + postData["orderAmount"] + postData["referenceId"] + postData["txStatus"] + postData["paymentMode"] + postData["txMsg"] + postData["txTime"]

 message = bytes(signatureData).encode('utf-8')
 #get secret key from your config
 secret = bytes(secretKey).encode('utf-8')
 signature = base64.b64encode(hmac.new(secret, 
   message,digestmod=hashlib.sha256).digest())

到目前为止，我能够提出以下代码。但是，生成的和接收的签名不匹配。

var hmac = crypto.createHmac('sha256', "appSecret"); //Key hidden for posting here
hmac.update(request.body.orderId + request.body.orderAmount+request.body.referenceId+request.body.txStatus+request.body.paymentMode+request.body.txMsg+request.body.txTime);
let generatedSignature = hmac.digest('hex');
let isSignatureValid = generatedSignature == request.body.cashfreeSignature;

console.log(isSignatureValid);

【参考方案1】：

您是否尝试过比较 base64 编码与十六进制值？

代替

let generatedSignature = hmac.digest('hex');

使用

let generatedSignature = hmac.digest('base64');