{"record":{"id":"a03264ca83b9d2be","repo":"JeffreySu/WeiXinMPSDK","slug":"sessionid-01","errorCode":null,"errorMessage":"SessionId无效（01）","messagePattern":"SessionId无效（01）","errorType":"exception","errorClass":"WxOpenException","httpStatus":null,"severity":"error","filePath":"src/Senparc.Weixin.WxOpen/src/Senparc.Weixin.WxOpen/Senparc.Weixin.WxOpen/Helpers/EncryptHelper.cs","lineNumber":111,"sourceCode":"            var signature = Senparc.CO2NET.Helpers.EncryptHelper.GetSha1(rawData + sessionKey);\n            //Senparc.Weixin.Helpers.EncryptHelper.SHA1_Encrypt(rawData + sessionKey);\n            return signature;\n        }\n\n        /// <summary>\n        /// 比较签名是否正确\n        /// </summary>\n        /// <param name=\"sessionId\"></param>\n        /// <param name=\"rawData\"></param>\n        /// <param name=\"compareSignature\"></param>\n        /// <exception cref=\"WxOpenException\">当SessionId或SessionKey无效时抛出异常</exception>\n        /// <returns></returns>\n        public static bool CheckSignature(string sessionId, string rawData, string compareSignature)\n        {\n            var sessionBag = SessionContainer.GetSession(sessionId);\n            if (sessionBag == null)\n            {\n                throw new WxOpenException(\"SessionId无效（01）\");\n            }\n\n            if (string.IsNullOrEmpty(sessionBag.SessionKey))\n            {\n                throw new WxOpenException(\"SessionKey无效（02）\");\n            }\n\n            var signature = GetSignature(rawData, sessionBag.SessionKey);\n            return signature == compareSignature;\n        }\n\n        #endregion\n\n        #region 解密\n\n        #region 私有方法\n\n        private static byte[] AES_Decrypt(String Input, byte[] Iv, byte[] Key, int keySize = 128)","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/JeffreySu/WeiXinMPSDK/blob/be573f6f94bdbf718dd5f6cdecb137fbc7ff651e/src/Senparc.Weixin.WxOpen/src/Senparc.Weixin.WxOpen/Senparc.Weixin.WxOpen/Helpers/EncryptHelper.cs#L93-L129","documentation":"Thrown by EncryptHelper.CheckSignature when SessionContainer.GetSession returns no session for the provided sessionId, i.e. the client-supplied SessionId does not correspond to any stored WxOpen session. Without a session there is no SessionKey against which to verify the rawData signature, so a WxOpenException with code (01) is raised.","triggerScenarios":"Calling EncryptHelper.CheckSignature(sessionId, rawData, compareSignature) with an invalid, expired, or evicted sessionId; passing a sessionId from a different cache instance or after cache restart; client sending a forged/garbage session id.","commonSituations":"Session cache expiration or memory cache restart between js2session call and signature check; multi-server deployment without a shared distributed cache; appId/appSecret changed so sessions were flushed; frontend sending stale sessionId from old login.","solutions":["Ensure the login flow calls JsCode2Session (creating the session) before any CheckSignature call and pass that sessionId","Use a distributed cache (Redis) so sessions survive restarts and are shared across servers","Have the client re-login to obtain a fresh SessionId when this error occurs","Catch WxOpenException and return an auth-expired response prompting re-login"],"exampleFix":"// before\nvar ok = EncryptHelper.CheckSignature(sessionId, rawData, signature); // throws if sessionId expired\n// after\nvar session = SessionContainer.GetSession(sessionId);\nif (session == null) {\n    // force re-login to get a new session\n    return RedirectLogin();\n}\nvar ok = EncryptHelper.CheckSignature(sessionId, rawData, signature);","handlingStrategy":"validation","validationCode":"var session = SessionContainer.GetSession(sessionId);\nif (session == null) {\n    // session missing — trigger client re-login before CheckSignature\n    return RequireRelogin();\n}","typeGuard":"bool SessionExists(string sessionId) => SessionContainer.GetSession(sessionId) != null;","tryCatchPattern":"try {\n    var ok = EncryptHelper.CheckSignature(sessionId, rawData, compareSignature);\n} catch (WxOpenException ex) when (ex.Message.Contains(\"SessionId无效\")) {\n    return Unauthorized(\"session expired, please re-login\");\n}","preventionTips":["Always create the session via jscode2session before any signature check","Use a shared distributed cache so sessions survive restarts and load balancing","Set generous session timeouts; decrypt/verify shortly after login","Return a distinct 'session expired' code so the mini-program re-runs wx.login"],"tags":["weixin","wxopen","session","signature","cache"],"backgroundTag":"record-not-found","analyzedSha":"be573f6f94bdbf718dd5f6cdecb137fbc7ff651e","analyzedAt":"2026-09-12T10:01:50.733Z","contentChangedAt":"2026-09-12T10:01:50.733Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}