//注意返回echostr字符串类型微信只接受“application/x-www-form-urlencoded”，直接返回是不被接受的

public HttpResponseMessage Get(string signature, string timestamp, string nonce, string echostr)
        {
            if (CheckSource(signature, timestamp, nonce))
            {
                var result = new StringContent(echostr, UTF8Encoding.UTF8, "application/x-www-form-urlencoded");
                var response = new HttpResponseMessage { Content = result };
                return response;
            }
            return new HttpResponseMessage();
        }

//检验是否来自微信的签名
 public bool CheckSource(string signature, string timestamp, string nonce)
        {
            var str = string.Empty;
            var token = "cwtesttoken";
            var parameter = new List<string> { token, timestamp, nonce };
            parameter.Sort();
            var parameterStr = parameter[0] + parameter[1] + parameter[2];
            var tempStr = GetSHA1(parameterStr).Replace("-", "").ToLower();
            if (tempStr == signature)
                return true;

            return false;
        }

        //SHA1加密
        public string GetSHA1(string input)
        {
            var output = string.Empty;
            var sha1 = new SHA1CryptoServiceProvider();
            var inputBytes = UTF8Encoding.UTF8.GetBytes(input);
            var outputBytes = sha1.ComputeHash(inputBytes);
            sha1.Clear();
            output = BitConverter.ToString(outputBytes);
            return output;
        }