protected boolean checkMessage(HttpServletRequest req, HttpServletResponse resp,
			boolean response) throws IOException {
		final String signature = req.getParameter("signature");
		final String timestamp = req.getParameter("timestamp");
		final String nonce = req.getParameter("nonce");
		final String echostr = req.getParameter("echostr");

		final String TOKEN = getInitParameter("TOKEN");
		if (null != signature && null != timestamp && null != nonce && null != echostr
				&& null != TOKEN) {
			logger.debug(String.format(
					"signature:%1$s timestamp:%2$s nonce:%3$s echostr:%4$s TOKEN:%5$s", signature,
					timestamp, nonce, echostr, TOKEN));

			final String[] list = Tools.toArrayString(TOKEN, timestamp, nonce);
			if (null != list) {
				Arrays.sort(list);
			}

			String weixin = Tools.joinStrings(list);

			logger.debug("add array:" + weixin);

			weixin = EncoderHandler.encode("SHA1", weixin);
			logger.debug("array sha1:" + weixin);

			if (signature.equals(weixin)) {
				// 验证成功
				if (response)
					resp.getWriter().write(echostr);
				return true;
			} else {
				resp.getWriter().write("valid fail");
			}
		} else {
			logger.warn("require parameter signature,timestamp,nonce,echostr");
		}
		return false;
	}