26 lines
835 B
PHP
26 lines
835 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace app\common\service;
|
|
|
|
/** 腾讯 IM 回调签名：sha256(Token . RequestTime)，只接受一分钟以内的请求。 */
|
|
class ImCallbackSignature
|
|
{
|
|
public static function verify(string $token, mixed $requestTime, mixed $sign, ?int $now = null): bool
|
|
{
|
|
if (trim($token) === '' || (!is_string($requestTime) && !is_int($requestTime)) || !is_string($sign)) {
|
|
return false;
|
|
}
|
|
$timestamp = (string) $requestTime;
|
|
if (preg_match('/^[0-9]{1,12}$/D', $timestamp) !== 1 || preg_match('/^[a-fA-F0-9]{64}$/D', $sign) !== 1) {
|
|
return false;
|
|
}
|
|
if (abs(($now ?? time()) - (int) $timestamp) > 60) {
|
|
return false;
|
|
}
|
|
|
|
return hash_equals(hash('sha256', $token . $timestamp), strtolower($sign));
|
|
}
|
|
}
|