sud.getUserProfile

Retrieves sensitive user information (high security level / full encryption flow). The result is ciphertext encrypted and signed with the current session's session_key. The client cannot decrypt it and must pass it unchanged to Game SVR for signature verification and decryption.

Parameters

Object object

Property	Type	Default	Required	Description
success	function		No	Callback for a successful retrieval
fail	function		No	Callback for a failed retrieval
complete	function		No	Callback invoked when the call ends, after either success or failure

Callback Parameters

success

Property	Type	Description
userInfo	Object	Basic user information; see the userInfo table below
rawData	string	Original data string excluding sensitive information, used to compute the signature
encryptedData	string	Base64 ciphertext produced by encrypting the sensitive information with AES-128-CBC
iv	string	Base64 encoding of the 16-byte random IV used for AES encryption
signature	string	Lowercase hexadecimal string produced by SHA1 over rawData concatenated with session_key

userInfo

Property	Type	Description
nickname	string	User nickname
avatar	string	User avatar
avatarUrl	string	Remote URL of the user avatar. Only the userInfo of this API returns this field

fail

Property	Type	Description
errCode	number	Error code
errMsg	string	Error message

complete carries no arguments. It is invoked after success or fail, and runs only once per request.

Notes

• Do not attempt to decrypt on the client. Submit encryptedData to Game SVR, which verifies the signature and decrypts it using the same session_key saved during login.
• Submit the original values of rawData, encryptedData, iv, and signature. When verifying the signature, Game SVR must use the received rawData as-is and must not parse and re-serialize it; differences in spaces, line breaks, or escaping will cause verification to fail.
• Use the session_key obtained from the same auth.code2session call as this login. Never use the key of another user, another game, or a previous session.
• Sensitive data is encrypted end to end. The client only relays it. Follow the data minimization principle: collect and store only the sensitive fields the current business explicitly needs and the user has authorized.

Example Code

sud.getUserProfile({
    success: (res) => {
        console.log('User nickname', res.userInfo.nickname);
        console.log('Remote avatar URL', res.userInfo.avatarUrl);

        // The client only relays the data; do not attempt to decrypt it
        sendToGameServer({
            rawData: res.rawData,
            encryptedData: res.encryptedData,
            iv: res.iv,
            signature: res.signature,
            userInfo: res.userInfo,
        });
    },
    fail: (err) => {
        console.error('Failed to get sensitive user info', err.errCode, err.errMsg);
    },
    complete: () => {
        console.log('Get sensitive user info call finished');
    },
});