二十行Java代码带你过，微信公众号服务器校验

/*
 * 验证消息的确来自微信服务器
 * 1）将token、timestamp、nonce三个参数进行字典序排序
 * 2）将三个参数字符串拼接成一个字符串进行sha1加密
 * 3）开发者获得加密后的字符串可与signature对比，标识该请求来源于微信
 * */
@RequestMapping("/xzlawin/wxget")
public void xzlawin(@RequestParam(value="signature")String signature,@RequestParam(value="timestamp")String timestamp,
                    @RequestParam(value="nonce")String nonce,@RequestParam(value="echostr")String echostr,
                    HttpServletRequest request,HttpServletResponse response) throws IOException
{
    System.out.println("signature="+signature+",timestamp="+timestamp+",nonce="+nonce+",echostr="+echostr);
    String[] arr = {TOKEN,timestamp,nonce};
    Arrays.sort(arr);
    StringBuffer sb = new StringBuffer();
    for(String a:arr) {
        sb.append(a);
    }
    System.out.println("数组字典排序结果:"+sb.toString());
    String sha1Msg = DigestUtils.sha1Hex(sb.toString().getBytes());
    System.out.println("sha1Msg:"+sha1Msg);
    if(signature.equals(sha1Msg)) {
        System.out.println("验证成功！");
        response.getWriter().println(echostr);
    }
}