JeffreySu/WeiXinMPSDK · error · ArgumentException

EncodingAESKey 必须为 43 个字符。

Error message

EncodingAESKey 必须为 43 个字符。

What it means

WeChat Work's EncodingAESKey is exactly 43 Base64 characters (decoding to a 32-byte AES key; the code appends '=' before decoding). DecryptResource validates this before decrypting the notification resource and throws ArgumentException when the key is null, empty, or the wrong length.

Solutions

1. Verify the EncodingAESKey from the WeChat Work admin console is exactly 43 characters and trim surrounding whitespace before passing it
2. Check the configuration source (appsettings/env var) actually contains the AES key, not the Token or other credential
3. Log the key length (not the key) at the call site to confirm what is being passed

Example fix

// before
string result = message.DecryptResource(aesKey);
// after
string key = config.EncodingAesKey?.Trim();
if (string.IsNullOrEmpty(key) || key.Length != 43)
    throw new InvalidOperationException($"EncodingAESKey length is {key?.Length ?? 0}, expected 43");
string result = message.DecryptResource(key);

var key = config.EncodingAesKey?.Trim();
if (string.IsNullOrEmpty(key) || key.Length != 43)
    throw new InvalidOperationException($"EncodingAESKey must be 43 chars, got {key?.Length ?? 0}");

static bool IsValidEncodingAesKey(string key) =>
    !string.IsNullOrEmpty(key) && key.Length == 43 && Convert.TryFromBase64String(key + "=", new byte[32], out _);

try { var plain = msg.DecryptResource(aesKey); }
catch (ArgumentException ex) when (ex.ParamName == "encodingAesKey") { log.Error("Invalid EncodingAESKey length"); throw; }

When it happens

Trigger: Calling DecryptResource with a null/empty key, a truncated key copied from the WeChat Work admin console, or a key with whitespace/newline included.

Common situations: Misconfigured callback credentials: pasting the EncodingAESKey without the final characters, confusing EncodingAESKey with Token, or storing the key in config with trailing whitespace.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• 注册委托容量必须大于 0。
• AppId 不能为空。
• AppId 不能为空。
• 不能为空。
• out_trade_no、transaction_id、sub_order_no 和 sub_order_id…

AI-assisted analysis of JeffreySu/WeiXinMPSDK@be573f6f94 (2026-09-12). Data as JSON: /api/errors/43876e84c9e7bd24. Report an issue: GitHub.

Appendix: source

Thrown at src/Senparc.Weixin.Work/Senparc.Weixin.Work/Entities/Request/Event/RequestMessageEvent_MiniProgramPay.cs:72

        public MiniProgramPayNotificationResource resource { get; set; }

        /// <summary>通知摘要。</summary>
        public string summary { get; set; }

        /// <summary>
        /// 使用“对外收款”应用回调配置中的 EncodingAESKey 解密业务资源。
        /// .NET Framework 与 netstandard2.0 不提供平台 AES-GCM 实现，将抛出
        /// <see cref="PlatformNotSupportedException"/>；这些目标仍可接收完整加密通知模型。
        /// </summary>
        public string DecryptResource(string encodingAesKey)
        {
#if NET462 || NETSTANDARD2_0
            throw new PlatformNotSupportedException(
                "当前目标框架不提供 AES-GCM。请在 netstandard2.1、netcoreapp3.1 或更新目标中解密通知资源。");
#else
            if (string.IsNullOrEmpty(encodingAesKey) || encodingAesKey.Length != 43)
            {
                throw new ArgumentException("EncodingAESKey 必须为 43 个字符。", nameof(encodingAesKey));
            }

            if (resource == null)
            {
                throw new InvalidOperationException("通知中不包含 resource 节点。");
            }

            if (!string.Equals(resource.algorithm, "AEAD_AES_256_GCM", StringComparison.OrdinalIgnoreCase))
            {
                throw new NotSupportedException($"不支持的通知资源加密算法：{resource.algorithm}");
            }

            var key = Convert.FromBase64String(encodingAesKey + "=");
            var encrypted = Convert.FromBase64String(resource.ciphertext);
            const int tagSize = 16;
            if (encrypted.Length <= tagSize)
            {
                throw new CryptographicException("通知资源密文长度无效。");

View on GitHub (pinned to be573f6f94)