lib/Auth.js
function (queryObj) {
    if (arguments.length < 1) {
      throw paramError;
    }
    var hmac = queryObj.hmac;
    delete queryObj.hmac;
    return (Date.now() - new Date(queryObj.time_stamp).getTime() < timeOffset) &&
      (hmac === crypto.createHmac('sha256', this.app_secret)
        .update(decodeURIComponent(querystring.stringify(queryObj)), 'utf8')
        .digest('hex'));
  }
function (queryObj) {
    if (arguments.length < 1) {
      throw paramError;
    }
    var hmac = queryObj.hmac;
    delete queryObj.hmac;
    return (Date.now() - new Date(queryObj.time_stamp).getTime() < timeOffset) &&
      (hmac === crypto.createHmac('sha256', this.app_secret)
        .update(decodeURIComponent(querystring.stringify(queryObj)), 'utf8')
        .digest('hex'));
  }
验证 Hmac
@param {Object} queryObj 回调地址的参数对象
@return {boolean}