binarywang/WxJava · critical · RuntimeException

响应的appId不符

Error message

响应的appId不符 

What it means

Thrown as RuntimeException when the 'Wechatmp-Appid' header in the API signature response does not match the appId used in the request. This is a response integrity check in the postWithSignature() flow to detect response tampering or routing errors. The mismatched appId is included in the message.

Source

Thrown at weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/BaseWxMaServiceImpl.java:1031

          new PSSParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 32, 1);
      signature.setParameter(pssParameterSpec);
      signature.initSign(priKey);
      signature.update(dataBuffer);
      byte[] sigBuffer = signature.sign();
      String signatureString = base64Encode(sigBuffer);

      Map<String, String> header = new HashMap<>();
      header.put("Wechatmp-Signature", signatureString);
      header.put("Wechatmp-Appid", appId);
      header.put("Wechatmp-TimeStamp", String.valueOf(timestamp));
      header.put("Wechatmp-Serial", rsaKeySn);
      log.debug("发送请求uri:{}, headers:{}, postData:{}", url, header, requestJson);
      WxMaApiResponse response =
          this.execute(ApiSignaturePostRequestExecutor.create(this), url, header, requestJson);
      String respTs = response.getHeaders().get("Wechatmp-TimeStamp");
      String respAad = urlPath + "|" + appId + "|" + respTs + "|" + aesKeySn;
      if (!appId.equals(response.getHeaders().get("Wechatmp-Appid"))) {
        throw new RuntimeException("响应的appId不符 " + response.getHeaders().get("Wechatmp-Appid"));
      }
      // 省略验证平台签名部分，直接解密内容，返回明文
      String decryptedData = aesDecodeResponse(response, respAad, aesKeySpec);
      log.debug("解密后的响应:{}", decryptedData);
      WxError error = WxError.fromJson(decryptedData, WxType.MiniApp);
      if (error.getErrorCode() != 0) {
        log.debug("调用API出错， uri:{}, postData:{}, response:{}", url, plainText, error);
        throw new WxErrorException(error);
      }
      return decryptedData;
    } catch (WxErrorException | SecurityException ex) {
      throw ex;
    } catch (Exception e) {
      log.error("postWithSignature", e);
      throw new RuntimeException(e);
    }
  }

View on GitHub (pinned to 1c43293a3c)

Solutions

1. Verify the appId in your WxMaConfig matches the appId registered with WeChat for your miniapp
2. Check for MITM proxies, corporate firewalls, or API gateways that might rewrite response headers
3. Ensure TLS/SSL certificate verification is enabled on your HTTP client (not disabled for debugging)
4. If the response genuinely contains a wrong appId with no proxy interference, report to WeChat support

// Verify appId config before making signed requests
String appId = wxMaConfig.getWechatMpAppid();
if (appId == null || appId.isEmpty()) {
  throw new IllegalStateException("WechatMpAppid is required for postWithSignature");
}
service.postWithSignature(url, jsonObject);

try {
  service.postWithSignature(url, jsonObject);
} catch (RuntimeException e) {
  if (e.getMessage().contains("appId不符")) {
    log.error("Response appId mismatch — possible MITM or config error");
    // alert security team, check proxy/CDN config
  } else {
    throw e;
  }
}

When it happens

Trigger: The WeChat API response to a signed request contains a 'Wechatmp-Appid' header value that differs from the appId configured in the request. This can occur due to MITM interference, proxy rewriting, or a WeChat platform routing anomaly.

Common situations: Corporate proxy or API gateway rewriting response headers; misconfigured appId in WxMaConfig (e.g., using the wrong app's ID); WeChat platform internal routing error; TLS interception by a security appliance.

Related errors

• ApiSignatureRsaPrivateKeySn不能为空，请检查配置
• 解析AES KEY失败，请检查ApiSignatureAesKey是否正确
• 解析RSA KEY失败，请检查ApiSignatureRsaPrivateKey是否正确，需要PKCS8格式私钥
• 请确保微信公众号配置 appId 的唯一性
• 请确保微信小程序配置 appId 的唯一性

AI-assisted analysis of binarywang/WxJava@1c43293a3c (2026-08-14). Data as JSON: /api/errors/447222722ff1e770. Report an issue: GitHub.