public Response unprotectResponse ( Response response ) throws IOException { try { if ( ! supportsProtection ( ) || ! HttpHeaders . hasBody ( response ) ) { return response ; } if ( ! response . header ( "content-type" ) . toLowerCase ( ) . contains ( "application/jose+json" ) ) { return response ; } JWSObject jwsObject = JWSObject . deserialize ( response . body ( ) . string ( ) ) ; JWSHeader jwsHeader = jwsObject . jwsHeader ( ) ; if ( ! jwsHeader . kid ( ) . equals ( serverSignatureKey . kid ( ) ) || ! jwsHeader . alg ( ) . equals ( "RS256" ) ) { throw new IOException ( "Invalid protected response" ) ; } byte [ ] data = ( jwsObject . originalProtected ( ) + "." + jwsObject . payload ( ) ) . getBytes ( MESSAGE_ENCODING ) ; byte [ ] signature = MessageSecurityHelper . base64UrltoByteArray ( jwsObject . signature ( ) ) ; RsaKey serverSignatureRsaKey = new RsaKey ( serverSignatureKey . kid ( ) , serverSignatureKey . toRSA ( false ) ) ; boolean signed = serverSignatureRsaKey . verifyAsync ( getSha256 ( data ) , signature , "RS256" ) . get ( ) ; if ( ! signed ) { throw new IOException ( "Wrong signature." ) ; } String decrypted = unprotectPayload ( jwsObject . payload ( ) ) ; MediaType contentType = response . body ( ) . contentType ( ) ; ResponseBody body = ResponseBody . create ( contentType , decrypted ) ; return response . newBuilder ( ) . body ( body ) . build ( ) ; } catch ( ExecutionException e ) { // unexpected; return null ; } catch ( InterruptedException e ) { // unexpected; return null ; } catch ( NoSuchAlgorithmException e ) { // unexpected; return null ; } }
Unprotects response if needed . Replaces its body with unencrypted version .