The superapp's payment uses its certificate's private key to perform SHA256 with RSA signing on the "response signature string," and then encodes the signature result using Base64 to obtain the signature value..
Construct the signature string
1. Get the following information from the response or notification callback:
HTTP Header Wechatpay-Timestamp: The response timestamp.
HTTP Header Wechatpay-Nonce: The response nonce.
Response body: Use the original response body for verification. Ensure that any framework used does not alter the response body, as any modification will result in verification failure.
2. Construct the response signature string according to the following rules. The signature string consists of three lines, each ending with a newline character (\\n, ASCII value 0x0A). If the response body is empty (e.g., HTTP status code 204 No Content), the last line will be just a newline character.
Request timestamp\\n
Request random string\\n
Request body\\n
Get the response signature
The response signature from the supperapp's payment is transmitted via the HTTP header Wechatpay-Signature. (Note: Examples may contain line breaks, but actual data should be in one line). Use Base64 decoding on the Wechatpay-Signature field value to obtain the response signature.
Verify the signature
Use the superapp's payment public key to verify the signature string and SHA256 with RSA signature.