{"record":{"id":"447222722ff1e770","repo":"binarywang/WxJava","slug":"appid-447222","errorCode":null,"errorMessage":"响应的appId不符 ","messagePattern":"响应的appId不符 ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/BaseWxMaServiceImpl.java","lineNumber":1031,"sourceCode":"          new PSSParameterSpec(\"SHA-256\", \"MGF1\", MGF1ParameterSpec.SHA256, 32, 1);\n      signature.setParameter(pssParameterSpec);\n      signature.initSign(priKey);\n      signature.update(dataBuffer);\n      byte[] sigBuffer = signature.sign();\n      String signatureString = base64Encode(sigBuffer);\n\n      Map<String, String> header = new HashMap<>();\n      header.put(\"Wechatmp-Signature\", signatureString);\n      header.put(\"Wechatmp-Appid\", appId);\n      header.put(\"Wechatmp-TimeStamp\", String.valueOf(timestamp));\n      header.put(\"Wechatmp-Serial\", rsaKeySn);\n      log.debug(\"发送请求uri:{}, headers:{}, postData:{}\", url, header, requestJson);\n      WxMaApiResponse response =\n          this.execute(ApiSignaturePostRequestExecutor.create(this), url, header, requestJson);\n      String respTs = response.getHeaders().get(\"Wechatmp-TimeStamp\");\n      String respAad = urlPath + \"|\" + appId + \"|\" + respTs + \"|\" + aesKeySn;\n      if (!appId.equals(response.getHeaders().get(\"Wechatmp-Appid\"))) {\n        throw new RuntimeException(\"响应的appId不符 \" + response.getHeaders().get(\"Wechatmp-Appid\"));\n      }\n      // 省略验证平台签名部分，直接解密内容，返回明文\n      String decryptedData = aesDecodeResponse(response, respAad, aesKeySpec);\n      log.debug(\"解密后的响应:{}\", decryptedData);\n      WxError error = WxError.fromJson(decryptedData, WxType.MiniApp);\n      if (error.getErrorCode() != 0) {\n        log.debug(\"调用API出错， uri:{}, postData:{}, response:{}\", url, plainText, error);\n        throw new WxErrorException(error);\n      }\n      return decryptedData;\n    } catch (WxErrorException | SecurityException ex) {\n      throw ex;\n    } catch (Exception e) {\n      log.error(\"postWithSignature\", e);\n      throw new RuntimeException(e);\n    }\n  }\n","sourceCodeStart":1013,"sourceCodeEnd":1049,"githubUrl":"https://github.com/binarywang/WxJava/blob/1c43293a3c2c9d7e91304b6d037fb017f680d0c6/weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/BaseWxMaServiceImpl.java#L1013-L1049","documentation":"Thrown as RuntimeException when the 'Wechatmp-Appid' header in the API signature response does not match the appId used in the request. This is a response integrity check in the postWithSignature() flow to detect response tampering or routing errors. The mismatched appId is included in the message.","triggerScenarios":"The WeChat API response to a signed request contains a 'Wechatmp-Appid' header value that differs from the appId configured in the request. This can occur due to MITM interference, proxy rewriting, or a WeChat platform routing anomaly.","commonSituations":"Corporate proxy or API gateway rewriting response headers; misconfigured appId in WxMaConfig (e.g., using the wrong app's ID); WeChat platform internal routing error; TLS interception by a security appliance.","solutions":["Verify the appId in your WxMaConfig matches the appId registered with WeChat for your miniapp","Check for MITM proxies, corporate firewalls, or API gateways that might rewrite response headers","Ensure TLS/SSL certificate verification is enabled on your HTTP client (not disabled for debugging)","If the response genuinely contains a wrong appId with no proxy interference, report to WeChat support"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Verify appId config before making signed requests\nString appId = wxMaConfig.getWechatMpAppid();\nif (appId == null || appId.isEmpty()) {\n  throw new IllegalStateException(\"WechatMpAppid is required for postWithSignature\");\n}\nservice.postWithSignature(url, jsonObject);","typeGuard":null,"tryCatchPattern":"try {\n  service.postWithSignature(url, jsonObject);\n} catch (RuntimeException e) {\n  if (e.getMessage().contains(\"appId不符\")) {\n    log.error(\"Response appId mismatch — possible MITM or config error\");\n    // alert security team, check proxy/CDN config\n  } else {\n    throw e;\n  }\n}","preventionTips":["Verify the appId in WxMaConfig matches your registered WeChat miniapp","Ensure TLS/SSL verification is not disabled on your HTTP client","Audit network path for proxies, gateways, or security appliances that rewrite headers","Treat appId mismatch as a potential security incident — investigate before retrying"],"tags":["security","miniapp","api-signature","integrity","response-validation"],"backgroundTag":null,"analyzedSha":"1c43293a3c2c9d7e91304b6d037fb017f680d0c6","analyzedAt":"2026-08-14T02:29:11.060Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}