Cloud call: prevent leakage, safe and secure use

For many developers, calling the WeChat open service interface is already a routine operation.

For example, to develop a small program, you can access services such as subscription news, OCR, and live broadcast by calling various open components and API interfaces encapsulated by WeChat.

While elegant calls often only require the simplest operation method, as simple as possible the call path can improve development efficiency.

In the past, the normal call of the WeChat open service interface required the developer to use the key information to obtain the access_token and to maintain the validity period and security of the token . Obtaining access_token involves a key exchange request. For companies and developers with general security awareness or limited R&D conditions, it is easy for expose the key and cause to be stolen.

So, is there a more efficient and safer calling method that enables multi-terminal applications such as small programs and official account pages in the WeChat ecosystem to be called quickly and well, so that the business can avoid calling bugs quickly?

"Cloud call" was born. It naturally has the " authentication-free call WeChat open service interface" feature. Through cloud call, developers no longer need to maintain authentication information such as access_token, and they can easily call WeChat open services by writing a small amount of code. The interface is very convenient; at the same time, for the judgment of the legitimacy of the interface request, the entire cloud call is through the 161adfb4c3683c WeChat private link , which can effectively avoid the security risks that may be brought by public network access, and the performance overhead is also smaller.

Take the WeChat payment interface as an example. Using cloud calls, developers don't need to care about certificates, authentication, WeChat payment server documents, etc., and a line of code can call the corresponding interface.

How to use cloud call?

Both WeChat cloud development and WeChat cloud hosting support the use of cloud calls, and the specific implementation forms of the two are different:

micro-channel cloud development cloud call, the main access to open service interface calls wx-server-sdk function through the cloud, requires Node.js and other related knowledge, and therefore suitable for the partial front-end and full-stack development team.

https://developers.weixin.qq.com/miniprogram/dev/wxcloud/guide/openapi/openapi.html

The sample code is as follows:

const cloud = require('wx-server-sdk')
cloud.init({ env: cloud.DYNAMIC_CURRENT_ENV })
exports.main = async (event, context) => {
  return await cloud.openapi.security.msgSecCheck-v1({ content:"安全检查测试文本" })
}

WeChat cloud hosting does not restrict the development language and framework. The cloud hosting background will periodically push the access_token token (similar to the "verification code") required to call the open interface to the container instance of the service At this time, you only need to read the "verification code" from the container locally, and then you can call it after packaging the request, which is more suitable for back-end and full-stack development teams as a whole.

https://developers.weixin.qq.com/miniprogram/dev/wxcloudrun/src/guide/weixin/token.html

The sample code is as follows:

const fs = require('fs')
const request = require('request')
const token = fs.readFileSync('/.tencentcloudbase/wx/cloudbase_access_token', 'utf-8')
return new Promise((resolve, reject) => {
  request({
    url: `https://api.weixin.qq.com/wxa/msg_sec_check?cloudbase_access_token=${token}`,
    body: JSON.stringify({ content:"安全检查测试文本" }),
  },async function (error, response) {
    resolve(JSON.parse(response.body))
  })
})

No matter which development mode is selected, after using the cloud call, the access will be completed in the WeChat private link, which can ensure business security. For businesses with a front-end and back-end separation architecture, it is more recommended to use WeChat cloud hosting as a back-end service.

At present, a large number of businesses of different scales have obtained faster and better security through WeChat cloud hosting, reaching the prevent "fleece", prevent DDoS attacks, and optimize network delay .

In addition, WeChat Cloud Hosting also launched the " No Threshold Deployment " function, which supports the rapid creation of a WeChat cloud hosting service through a preset open source framework, and initiates requests for the service through various calling methods, which greatly reduces the threshold of use. Welcome to experience.

https://developers.weixin.qq.com/miniprogram/dev/wxcloudrun/src/quickstart/template/

Regarding the login method, WeChat Cloud Hosting has added support for official account login. New features such as one-click migration, static resource storage, and WebSocket will also be launched soon, so stay tuned.

more information

WeChat cloud hosting official website (please visit the following address on the PC side)

https://cloud.weixin.qq.com/

Official WeChat Cloud Hosting Document

https://developers.weixin.qq.com/miniprogram/dev/wxcloudrun/src/basic/intro.html

WeChat Cloud Hosting Series Tutorial

https://developers.weixin.qq.com/community/business/course/00068c2c0106c0667f5b01d015b80d

WeChat Cloud Hosting Expert 1V1 Service

https://cloud.tencent.com/act/pro/cloudrun

WeChat Cloud Development/Cloud Hosting Incentive Plan

https://cloud.tencent.com/act/pro/wxcloudrun