Skip to content

新增微信小程序服务端检查登录态（checkSessionKey）接口 #3951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

新增微信小程序服务端检查登录态（checkSessionKey）接口 #3951

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
99fcf33
Initial plan
Copilot Apr 7, 2026
47add3a
新增微信小程序检查登录状态（checkSessionKey）接口实现
Copilot Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/WxMaUserService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,4 +108,20 @@ public interface WxMaUserService {
* @throws WxErrorException 调用微信接口失败时抛出
*/
WxMaCode2VerifyInfoResult getCode2VerifyInfo(String code, String checkcode) throws WxErrorException;

/**
* 检查登录态（checkSessionKey）.
* <p>
* 检验登录态是否有效，用于虚拟支付等场景构建用户签名前的登录态验证。
* 登录态有效时返回 {@code true}；登录态已失效时，微信服务端将返回错误码（如 87009），
* 并以 {@link me.chanjar.weixin.common.error.WxErrorException} 的形式抛出。
* </p>
* 文档地址：<a href="https://developers.weixin.qq.com/miniprogram/dev/server/API/user-login/api_checksessionkey.html">检查登录态</a>
*
* @param openid 用户唯一标识符
* @param sessionKey 用户的 session_key，通过 {@link #getSessionInfo(String)} 获取
* @return 登录态有效时返回 {@code true}
* @throws WxErrorException 登录态已失效或调用微信接口失败时抛出（失效时 errcode 为 87009）
*/
boolean checkSessionKey(String openid, String sessionKey) throws WxErrorException;
}
9 changes: 9 additions & 0 deletions weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/WxMaUserServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@

import java.util.Map;

import static cn.binarywang.wx.miniapp.constant.WxMaApiUrlConstants.User.CHECK_SESSION_KEY_URL;
import static cn.binarywang.wx.miniapp.constant.WxMaApiUrlConstants.User.CODE_2_VERIFY_INFO_URL;
import static cn.binarywang.wx.miniapp.constant.WxMaApiUrlConstants.User.GET_PHONE_NUMBER_URL;
import static cn.binarywang.wx.miniapp.constant.WxMaApiUrlConstants.User.SET_USER_STORAGE;
Expand Down Expand Up @@ -97,4 +98,12 @@ public WxMaCode2VerifyInfoResult getCode2VerifyInfo(String code, String checkcod
return WxMaCode2VerifyInfoResult.fromJson(responseContent);
}

@Override
public boolean checkSessionKey(String openid, String sessionKey) throws WxErrorException {
String signature = SignUtils.createHmacSha256Sign(openid, sessionKey);
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign empty payload when calling checkSessionKey

The checkSessionKey signature is computed as HMAC_SHA256(openid, sessionKey), but this API expects the signature generated by signing an empty string with session_key (hmac_sha256(session_key, "")). With the current implementation, even a valid session_key will consistently produce an invalid signature error (87009), so the method cannot successfully validate a real login session.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown

@augmentcode augmentcode bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/WxMaUserServiceImpl.java:103: According to the official checkSessionKey docs, the endpoint is /wxa/checksession and signature is hmac_sha256(session_key, "") (signing the empty string), so signing openid (and using /checksessionkey in the URL constant) will likely make this API always fail with 87009/invalid signature.

Severity: high

Other Locations
  • weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/constant/WxMaApiUrlConstants.java:371

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

String url = String.format(CHECK_SESSION_KEY_URL, openid, signature);
this.service.get(url, null);
return true;
}

}
3 changes: 3 additions & 0 deletions weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/constant/WxMaApiUrlConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,6 +366,9 @@ public interface User {
String GET_PHONE_NUMBER_URL = "https://api.weixin.qq.com/wxa/business/getuserphonenumber";
/** 多端登录验证接口 */
String CODE_2_VERIFY_INFO_URL = "https://api.weixin.qq.com/wxa/sec/checkcode2verifyinfo";
/** 检查登录态接口 */
String CHECK_SESSION_KEY_URL =
"https://api.weixin.qq.com/wxa/checksessionkey?openid=%s&signature=%s&sig_method=hmac_sha256";
}

public interface Ocr {
Expand Down
6 changes: 6 additions & 0 deletions ...java-miniapp/src/test/java/cn/binarywang/wx/miniapp/api/impl/WxMaUserServiceImplTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,4 +81,10 @@ public void testSetUserStorage() throws WxErrorException {
public void testGetAccessToken() throws Exception{
assertNotNull(wxService.getAccessToken(true));
}

@Test(expectedExceptions = WxErrorException.class)
Copy link
Copy Markdown

@augmentcode augmentcode bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

weixin-java-miniapp/src/test/java/cn/binarywang/wx/miniapp/api/impl/WxMaUserServiceImplTest.java:85: This test only asserts an exception for obviously-invalid inputs, so it can pass even if the request URL/signature computation is incorrect. It also doesn’t validate the success path (returning true) or the specific errcode (e.g., 87009) that the Javadoc mentions.

Severity: medium

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

public void testCheckSessionKey() throws WxErrorException {
// 使用无效的 openid 和 sessionKey，预期微信服务端返回错误（如 errcode=87009）并抛出 WxErrorException
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里的用例只断言会抛出 WxErrorException，但注释中写“如 errcode=87009”并不成立：传入的 openid 本身就是无效值时，更可能返回的是 openid 不合法等其它错误码，导致测试无法稳定验证“session_key 失效(87009)”这一场景。建议要么去掉对 87009 的暗示、仅说明预期抛异常；要么使用 test-config 中的真实 openid 并构造一个已失效/错误的 sessionKey，再断言具体 errorCode。

Suggested change
// 使用无效的 openid 和 sessionKey，预期微信服务端返回错误（如 errcode=87009）并抛出 WxErrorException
// 使用无效的 openid 和 sessionKey，预期微信服务端返回错误并抛出 WxErrorException

Copilot uses AI. Check for mistakes.
this.wxService.getUserService().checkSessionKey("invalid_openid", "invalid_session_key");
}
}