文档是以下:

https://developers.weixin.qq.com/minigame/dev/api-backend/open-api/login/auth.checkSessionKey.html

该接口获取signature的说明，真的是驴唇不对马嘴,我去网上搜的别人获取签名的方式，用的下面的方法。

func hmacHs256(message string, secret string) string {
    h := hmac.New(sha256.New, []byte(secret))
    io.WriteString(h, message)
    return fmt.Sprintf("%x", h.Sum(nil))
}    

该方法对大部分用户都可用，正常。但是经常会蹦出一些签名非法的用户，以下就是其中一个。

87009 invalid signature

	var openId = "oZKx35BPtZm_ANPLuqvjAVW7rQNo"
	var sessionKey = "1xLmVHJo4S1yxK7JayHDcA=="
        var accessToken = "30_uaVqxUD0gQr2dltg2S8-xnTysPe2d1Fu697y5rAMnyv9jaksw1-ub2xmySGSFscuf6dLH9d8zoZNOZSNXX5MGh5ERVNds8pwfQOgO5zCXhJjia2ARJnSbPIgTz8dVFinZG4wL47sRugNadyQFKUfAJAZEO"
        signature := hmacHs256("", sessionKey)

完整代码:

func CheckSessionKey(cli *http.Client, openId, accessToken, sessionKey string) (bool, error) {
    if cli == nil {
        cli = c
    }
    signature := hmacHs256("", sessionKey)
    fmt.Println(signature)
    var result = struct {
        Errcode int    `json:"errcode"`
        Errmsg  string `json:"errmsg"`
    }{}
    req, e := http.NewRequest("GET", fmt.Sprintf("https://api.weixin.qq.com/wxa/checksession?access_token=%s&signature=%s&openid=%s&sig_method=hmac_sha256", accessToken, signature, openId), nil)
    if e != nil {
        return false, errorx.Wrap(e)
    }
    rsp, e := cli.Do(req)
    if e != nil {
        return false, errorx.Wrap(e)
    }
    if rsp != nil && rsp.Body != nil {
        defer rsp.Body.Close()
    }
    buf, e := ioutil.ReadAll(rsp.Body)
    if e != nil {
        return false, errorx.Wrap(e)
    }
    e = json.Unmarshal(buf, &result)
    if e != nil {
        return false, errorx.Wrap(e)
    }
    // 正常
    if result.Errcode == 0 && result.Errmsg == "ok" {
        return true, nil
    }
    // 非法
    if result.Errcode == 87009 || result.Errcode == 87007 || result.Errmsg == "invalid signature" {
        fmt.Println(result.Errcode, result.Errmsg)
        return false, fmt.Errorf("sessionKey expired")
    }
    return false, errorx.NewFromStringf("got errcode '%d', errmsg '%s'", result.Errcode, result.Errmsg)
}