public static boolean isValidSignature ( HttpServletRequest incoming , String secretKey ) { if ( incoming == null || StringUtils . isBlank ( secretKey ) ) { return false ; } String auth = incoming . getHeader ( HttpHeaders . AUTHORIZATION ) ; String givenSig = StringUtils . substringAfter ( auth , "Signature=" ) ; String sigHeaders = StringUtils . substringBetween ( auth , "SignedHeaders=" , "," ) ; String credential = StringUtils . substringBetween ( auth , "Credential=" , "," ) ; String accessKey = StringUtils . substringBefore ( credential , "/" ) ; if ( StringUtils . isBlank ( auth ) ) { givenSig = incoming . getParameter ( "X-Amz-Signature" ) ; sigHeaders = incoming . getParameter ( "X-Amz-SignedHeaders" ) ; credential = incoming . getParameter ( "X-Amz-Credential" ) ; accessKey = StringUtils . substringBefore ( credential , "/" ) ; } Set < String > headersUsed = new HashSet <> ( Arrays . asList ( sigHeaders . split ( ";" ) ) ) ; Map < String , String > headers = new HashMap <> ( ) ; for ( Enumeration < String > e = incoming . getHeaderNames ( ) ; e . hasMoreElements ( ) ; ) { String head = e . nextElement ( ) . toLowerCase ( ) ; if ( headersUsed . contains ( head ) ) { headers . put ( head , incoming . getHeader ( head ) ) ; } } Map < String , String > params = new HashMap <> ( ) ; for ( Map . Entry < String , String [ ] > param : incoming . getParameterMap ( ) . entrySet ( ) ) { params . put ( param . getKey ( ) , param . getValue ( ) [ 0 ] ) ; } String path = incoming . getRequestURI ( ) ; String endpoint = StringUtils . removeEndIgnoreCase ( incoming . getRequestURL ( ) . toString ( ) , path ) ; String httpMethod = incoming . getMethod ( ) ; InputStream entity ; try { entity = new BufferedRequestWrapper ( incoming ) . getInputStream ( ) ; if ( entity . available ( ) <= 0 ) { entity = null ; } } catch ( IOException ex ) { logger . error ( null , ex ) ; entity = null ; } Signer signer = new Signer ( ) ; Map < String , String > sig = signer . sign ( httpMethod , endpoint , path , headers , params , entity , accessKey , secretKey ) ; String auth2 = sig . get ( HttpHeaders . AUTHORIZATION ) ; String recreatedSig = StringUtils . substringAfter ( auth2 , "Signature=" ) ; return StringUtils . equals ( givenSig , recreatedSig ) ; }
Validates the signature of the request .