亚马逊支付SDK无效SignatureError

Question

下面是我的php实现代码：

$amazonpay_config = array(
    'public_key_id' => 'XXXXXXXX',
    'private_key'   => 'my_private_key_path',
    'region'        => 'US',
    'sandbox'       => true
);
$payload = array(
    'webCheckoutDetails' => array(
        'checkoutReviewReturnUrl' => 'https://www.example.com/review',
        'checkoutResultReturnUrl' => 'https://www.example.com/result'
    ),
    'storeId' => 'amzn1.application-oa2-client.XXXXXXXXX'
);

$headers = array('x-amz-pay-Idempotency-Key' => uniqid());
$requestResult = [
    'error' => 1,
    'msg' => 'Error. Can not create checkout session.',
    'checkoutSession' => null,
    'payloadSign' => null
];

$client = new Client($amazonpay_config);
$resultCheckOut = $client->createCheckoutSession($payload, $headers);
$resultSignPayload = $client->generateButtonSignature($payload);

if($resultCheckOut['status'] !== 201) {
    return json_encode($requestResult, true);
}
else {
    $requestResult = [
        'error' => 0,
        'msg' => null,
        'checkoutSession' => json_decode($resultCheckOut['response']),
        'payloadSign' => $resultSignPayload
    ];
    return $requestResult;
}

这是用于生成Amazon Pay按钮的JS实现代码。

amazon.Pay.renderButton('#amazon-pay-btn', {
    // set checkout environment
    merchantId: 'XXXXXXXX',
    ledgerCurrency: 'USD',
    sandbox: true,
    checkoutLanguage: 'en_US',
    productType: 'PayOnly',
    placement: 'Cart',
    buttonColor: 'Gold',
    createCheckoutSessionConfig: {
        payloadJSON: jsonResult['checkoutSession'], 
        signature: jsonResult['payloadSign'], 
        publicKeyId: 'XXXXXXXXXXX'
    }
});

Answer 1

关于此问题的两条评论：

1. 我已将有效负载定义为字符串（这是当前Amazon Pay doc声明的方式-链接）。

$payload = '{
    "webCheckoutDetails": {
        "checkoutReviewReturnUrl": "https://www.example.com/review",
        "checkoutResultReturnUrl": "https://www.example.com/result"
    },
    "storeId": "amzn1.application-oa2-client.XXXXXXXXX"
}';

而不是数组

$payload = array(
    'webCheckoutDetails' => array(
        'checkoutReviewReturnUrl' => 'https://www.example.com/review',
        'checkoutResultReturnUrl' => 'https://www.example.com/result'
    ),
    'storeId' => 'amzn1.application-oa2-client.XXXXXXXXX'
);

签名已经创建，但是当呈现按钮并单击它时，我得到以下错误。

<代码>错误消息：签名Dk4qznkoiTVqjcY8Yn1l0iLbsoIj2pEAHWVtgYrphLtFXR9BKhJJPD53It4qYOswS1T/STYMHRY5JTCHGGQVLNTDJUY0MRHKPOHTPYETWDOQGHA2QK QnSGV5LoYldQ/UKAXSG7M8S2IOR11Q2SWXUJRK2M3FGZAIZJJJYEARJYEAR97EGANYVA3JTGDFM6CJDIENBM4WKQGIH6HXORY5K/GA26494VAWZAGVZGRHZG48FOVP/XCR0MBU6V5P5V5P5P5P5P5P5P5P5P5P5P5P5P5P5P5P5P5P5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P6V5P KEOZRJSC hN5WKAs/C49USFKPX75CE7QBABCZT1UICZFYYX/mBuZuysUlGmnXPhLOLTPw4 SIizH/pOQyClOQyw==不匹配商户XXXXXXXX的签名字符串AMZN-PAY-RSASSA-PSS dfff7a87b93cfa78685a233f2dd59e18ad0451b2e3a90af11e500fcc0ceee924

我花了一段时间才意识到这是错误的原因。实际上，在写这个的时候，字符串中的新行就是原因。如果字符串只在一行中，它就有效。

Answer 2

代码有几个问题，主要是您没有正确地将有效负载和签名传递给前端。对于有效负载，您使用的是jsonResult['check out会话']，而它应该是jsonResult['payloadSign']。虽然这不包含有效负载，但从PHP代码来看，它显然是您在其中放置的签名。完整的代码示例应该更像这样（未测试）。

后端：

$headers = array('x-amz-pay-Idempotency-Key' => uniqid());
$requestResult = [
    'error' => 1,
    'msg' => 'Error. Can not create checkout session.',
    'signature' => null,
    'payload' => null
];

$client = new Client($amazonpay_config);
$resultCheckOut = $client->createCheckoutSession($payload, $headers);
$resultSignature = $client->generateButtonSignature($payload);

if($resultCheckOut['status'] !== 201) {
    return json_encode($requestResult, true);
}
else {
    $requestResult = [
        'error' => 0,
        'msg' => null,
        'signature' => $resultSignature,
        'payload' => $payload
    ];
    return json_encode($requestResult);
}

前端：

amazon.Pay.renderButton('#amazon-pay-btn', {
    // set checkout environment
    merchantId: 'XXXXXXXX',
    ledgerCurrency: 'USD',
    sandbox: true,
    checkoutLanguage: 'en_US',
    productType: 'PayOnly',
    placement: 'Cart',
    buttonColor: 'Gold',
    createCheckoutSessionConfig: {
        payloadJSON: JSON.stringify(jsonResult['payload']), 
        signature: jsonResult['signature'], 
        publicKeyId: 'XXXXXXXXXXX'
    }
});

我不确定您如何将$Request estResult传回前端，可能需要一些额外的JSON编码/解码才能获得正确的字符串。为防止签名不匹配错误，请确保用于后端签名生成的有效负载字符串和分配给“payloadJSON”参数的有效负载字符串完全匹配（特别是注意空格、转义字符、换行符等）。