JeffreySu/WeiXinMPSDK · error · NotSupportedException

不支持的通知资源加密算法：

Error message

不支持的通知资源加密算法：{resource.algorithm}

What it means

AES-GCM decryption in this library only supports WeChat Work's mandated algorithm `AEAD_AES_256_GCM`. When resource.algorithm is anything else (or missing), the library refuses to attempt decryption with NotSupportedException, since the key/tag layout would be wrong.

Solutions

1. Inspect the raw notification and confirm resource.algorithm is AEAD_AES_256_GCM
2. If WeChat introduced a new algorithm, update the library or decrypt manually with a matching implementation
3. Treat non-matching algorithm callbacks as invalid/suspect and reject them at the webhook boundary

Example fix

// before
var plain = message.DecryptResource(aesKey);
// after
if (message.Resource?.algorithm?.Equals("AEAD_AES_256_GCM", StringComparison.OrdinalIgnoreCase) != true)
    return; // unsupported algorithm, log & reject
var plain = message.DecryptResource(aesKey);

if (!string.Equals(message.Resource?.algorithm, "AEAD_AES_256_GCM", StringComparison.OrdinalIgnoreCase))
    throw new NotSupportedException($"unsupported algorithm: {message.Resource?.algorithm}");

try { var plain = msg.DecryptResource(aesKey); }
catch (NotSupportedException ex) { log.Warn(ex.Message); return Results.StatusCode(400); } // reject suspect callback

When it happens

Trigger: Calling DecryptResource when the notification's resource.algorithm field is null, empty, or a value other than AEAD_AES_256_GCM (case-insensitive).

Common situations: WeChat platform changes the algorithm for new event types; malformed or forged callbacks in production; unit tests that stub a resource with a placeholder algorithm string.

Related errors

• 当前目标框架不提供 AES-GCM。请在 netstandard2.1、netcoreapp3.1…
• EncodingAESKey 必须为 43 个字符。
• Invalid hex length for uncompressed EC public key
• 通知资源密文长度无效。
• 通知中不包含 resource 节点。

AI-assisted analysis of JeffreySu/WeiXinMPSDK@be573f6f94 (2026-09-12). Data as JSON: /api/errors/30d57acacc2f7646. Report an issue: GitHub.

Appendix: source

Thrown at src/Senparc.Weixin.Work/Senparc.Weixin.Work/Entities/Request/Event/RequestMessageEvent_MiniProgramPay.cs:82

        public string DecryptResource(string encodingAesKey)
        {
#if NET462 || NETSTANDARD2_0
            throw new PlatformNotSupportedException(
                "当前目标框架不提供 AES-GCM。请在 netstandard2.1、netcoreapp3.1 或更新目标中解密通知资源。");
#else
            if (string.IsNullOrEmpty(encodingAesKey) || encodingAesKey.Length != 43)
            {
                throw new ArgumentException("EncodingAESKey 必须为 43 个字符。", nameof(encodingAesKey));
            }

            if (resource == null)
            {
                throw new InvalidOperationException("通知中不包含 resource 节点。");
            }

            if (!string.Equals(resource.algorithm, "AEAD_AES_256_GCM", StringComparison.OrdinalIgnoreCase))
            {
                throw new NotSupportedException($"不支持的通知资源加密算法：{resource.algorithm}");
            }

            var key = Convert.FromBase64String(encodingAesKey + "=");
            var encrypted = Convert.FromBase64String(resource.ciphertext);
            const int tagSize = 16;
            if (encrypted.Length <= tagSize)
            {
                throw new CryptographicException("通知资源密文长度无效。");
            }

            var ciphertext = new byte[encrypted.Length - tagSize];
            var tag = new byte[tagSize];
            var plaintext = new byte[ciphertext.Length];
            Buffer.BlockCopy(encrypted, 0, ciphertext, 0, ciphertext.Length);
            Buffer.BlockCopy(encrypted, ciphertext.Length, tag, 0, tag.Length);

            try
            {

View on GitHub (pinned to be573f6f94)