python3 + 支付宝app 接口，RSA/RSA2 签名、验签
1、生成(验证)签名的代码(安装包：pycryptodomex==3.9.4。有个sdk：python-alipay-sdk)，密钥类型RSA 用SHA。苹果手机验证通过，Android手机应该也一样
import binascii
import json
import urllib
from Cryptodome.Hash import SHA, SHA256
from Cryptodome.PublicKey import RSA
from Cryptodome.Signature import PKCS1_v1_5
from myapp.alipay.configs import alipay_public_key_begin_end, alipay_merchant_private_key_begin_end, sign_type
from utils.helper import SimException
class SignRSA(object):
MAXLINESIZE = 76 # Excluding the CRLF
MAXBINSIZE = (MAXLINESIZE // 4) * 3
def __init__(self, **kwargs):
self.kwargs = kwargs
self.sign_type = sign_type # rsa 用sha, rsa2方式用SHA256
self.private_key = alipay_merchant_private_key_begin_end
self.public_key = alipay_public_key_begin_end # alipay_sand_public_key_begin_end
if sign_type not in ("RSA", "RSA2"):
raise SimException("Unsupported sign type {}".format(sign_type))
@staticmethod
def get_ordered_data(data: dict):
# 还没生成签名 前不能传 sign 和 sign_type 进行排序
complex_keys = [k for k, v in data.items() if isinstance(v, dict)]
# 将字典类型的数据dump出来
for key in complex_keys:
data[key] = json.dumps(data[key], separators=(',', ':'))
return sorted([(k, v) for k, v in data.items()])
@staticmethod
def encode_for_sign(ordered_items):
unsigned_str = "&".join('''{}="{}"'''.format(k, v) for k, v in ordered_items)
return unsigned_str.encode('utf-8').decode('unicode_escape')
def verify_with_public_key(self, sign):
"""
:parameter sign:
The signature that needs to be validated.
:type sign: byte string
"""
ordered_item = self.get_ordered_data(self.kwargs)
params = "&".join(u"{}={}".format(k, v) for k, v in ordered_item)
# 公钥验签
signer = PKCS1_v1_5.new(RSA.importKey(self.public_key))
if self.sign_type == 'RSA':
msg_hash = SHA.new()
else:
msg_hash = SHA256.new()
msg_hash.update(params.encode("utf8"))
# sign = urllib.parse.unquote_plus(sign)
# sign = self.decodebytes(sign.encode()) # 反操作：base64 编码，转换为unicode表示并移除回车
return signer.verify(msg_hash, self.decodebytes(sign.encode("utf8"))) # true / false
def sign_with_private_key(self):
ordered_item = self.get_ordered_data(self.kwargs)
unsigned_str = self.encode_for_sign(ordered_item)
signer = PKCS1_v1_5.new(RSA.importKey(self.private_key))
# rsa 用sha, rsa2方式用SHA256
if self.sign_type == 'RSA':
rand_hash = SHA.new()
else:
rand_hash = SHA256.new()
rand_hash.update(unsigned_str.encode())
signature = signer.sign(rand_hash)
# base64 编码，转换为unicode表示并移除回车
sign = self.encodebytes(signature).decode("utf8").replace("\n", "")
# app支付中，对于参数sign，需要进行urlencode
sign = urllib.parse.quote_plus(sign)
data = self.kwargs
data['sign'] = sign
data['sign_type'] = self.sign_type
ordered_data = self.get_ordered_data(data)
return f'''{self.encode_for_sign(ordered_data)}'''
def encodebytes(self, s):
"""Encode a bytestring into a bytes object containing multiple lines
of base-64 data."""
self._input_type_check(s)
pieces = []
for i in range(0, len(s), self.MAXBINSIZE):
chunk = s[i: i + self.MAXBINSIZE]
pieces.append(binascii.b2a_base64(chunk))
return b"".join(pieces)
def decodebytes(self, byte_str):
"""Decode a bytestring of base-64 data into a bytes object."""
self._input_type_check(byte_str)
return binascii.a2b_base64(byte_str)
@staticmethod
def _input_type_check(s):
try:
m = memoryview(s)
except TypeError as err:
msg = "expected bytes-like object, not %s" % s.__class__.__name__
raise TypeError(msg) from err
if m.format not in ('c', 'b', 'B'):
msg = ("expected single byte elements, not %r from %s" %
(m.format, s.__class__.__name__))
raise TypeError(msg)
if m.ndim != 1:
msg = ("expected 1-D data, not %d-D data from %s" %
(m.ndim, s.__class__.__name__))
raise TypeError(msg)
class SimException(Exception):
def __init__(self, *args, **kwargs):
super(SimException, self).__init__(*args, **kwargs)
2）生成签名：partner、seller_id一样；境外收单不能用 CNY 且 网站、移动端都是申请(New Cross-border Online Payment(PC/WAP))；移动端使用NEW_WAP_OVERSEAS_SELLER，网站用WAP_OVERSEAS_SELLER；移动端和网站支付宝接口对应下面的data需要的参数也有所不同
data = {
'service': 'mobile.securitypay.pay',
'partner': '2088621948283543',
'_input_charset': 'UTF-8',
'subject': 'WT(随便取？)',
'out_trade_no': '自己系统生成的订单号',
'currency': 'USD',
"forex_biz": "FP",
"seller_id": '2088621948283543',
'total_fee': '0.01',
'refer_url': "http://www.wtf.com/",
'payment_type': 1,
'product_code': 'NEW_WAP_OVERSEAS_SELLER',
'trade_information': {
'business_type': '1',
'other_business_type': '嗯哼..'
},
'return_url': '自己系统后端 同步接口',
'notify_url': '自己系统后端 异步接口'
}
sign_rsa = SignRSA(**data)
order_info = sign_rsa.sign_with_private_key()
移动端将order_info通过sdk调用就可以唤醒支付宝并支付了
2、支付宝工具：
1）、支付宝签名调试工具：
https://isandbox.alipaydev.com/melitigo/Test_083.html
2）支付宝在线服务(要人工服务就回复 人工)
https://cschannel.alipay.com/mada.htm?scene=ef678de5d81cff29&envType=3
3）支付宝公私钥生成工具
https://isandbox.alipaydev.com/melitigo/Test_085.html
4）官方文档
https://global.alipay.com/doc/global/mobile_securitypay_pay
3、支付宝的通知(异步通知)
3、调用(python3)，除了sign_type、sign两个参数，其余都要参与签名过程
data = request.POST.dict()
sign = data.pop('sign', None)
data.pop('sign_type', None)
trade_status = data.get('trade_status', None)
out_trade_no = data.get('out_trade_no', None)
total_fee = data.get('total_fee', None)
trade_no = data.get('trade_no', None)
# 首先验签
sign_rsa = SignRSA(**data)
sign_rsa.verify_with_public_key(sign) # 返回 true 或 false
4、支付宝通知(同步通知。SDK返回的信息，移动端可以通过sdk收到)，即就是同步通知不需要进行验签直接关闭支付宝app就可以了？是的吧应该
