chenhg5/cc-connect · error

corp_id mismatch: expected %s, got %s

Error message

corp_id mismatch: expected %s, got %s

What it means

Trailing-field check at the end of decrypt: the corp_id appended after the message body in WeCom's plaintext layout does not equal this platform's configured corp_id. Decryption otherwise succeeded, which pinpoints the cause as a credential mix-up — the callback was encrypted for a different corp/app than the one configured here.

Source

Thrown at platform/wecom/wecom.go:784

	plain := make([]byte, len(cipherData))
	mode.CryptBlocks(plain, cipherData)

	plain = pkcs7Unpad(plain)

	if len(plain) < 20 {
		return "", fmt.Errorf("decrypted data too short")
	}

	msgLen := int(binary.BigEndian.Uint32(plain[16:20]))
	if 20+msgLen > len(plain) {
		return "", fmt.Errorf("invalid message length %d in decrypted data (total %d)", msgLen, len(plain))
	}

	msg := string(plain[20 : 20+msgLen])
	corpID := string(plain[20+msgLen:])

	if corpID != p.corpID {
		return "", fmt.Errorf("corp_id mismatch: expected %s, got %s", p.corpID, corpID)
	}

	return msg, nil
}

func pkcs7Unpad(data []byte) []byte {
	if len(data) == 0 {
		return data
	}
	pad := int(data[len(data)-1])
	if pad < 1 || pad > 32 || pad > len(data) {
		return data
	}
	return data[:len(data)-pad]
}

// downloadMedia fetches a temporary media file from WeChat Work by media_id.
func (p *Platform) resolveUserName(userID string) string {

View on GitHub (pinned to 4000b2338a)

Solutions

1. Confirm corp_id, EncodingAESKey and token in config.toml all come from the same WeCom app
2. If multiple corps route to one endpoint, split them into separate platform instances
3. Reject the mismatched callback; it was never meant for this deployment

When it happens

Trigger: Thrown at platform/wecom/wecom.go:784 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/9d163b0f82b2a907. Report an issue: GitHub.