### Question:
CEKRequestSignatureVerifier implements CEKRequestVerifier { @Override public void verify(HttpServletRequest request, CEKRequestMessage requestMessage, String requestJson, SystemContext system) { String baseEncoded64Signature = request.getHeader(CLOVA_SIGNATURE_REQUEST_HEADER); if (StringUtils.isBlank(baseEncoded64Signature)) { throw new SecurityException(CLOVA_SIGNATURE_REQUEST_HEADER + " is missing."); } try { Signature signature = Signature.getInstance(CLOVA_SIGNATURE_ALGORITHM); signature.initVerify(this.publicKey); signature.update(requestJson.getBytes(StandardCharsets.UTF_8)); if (signature.verify( Base64.getDecoder().decode(baseEncoded64Signature.getBytes(StandardCharsets.UTF_8)))) { return; } throw new SecurityException("Failed to verify the signature for the provided request."); } catch (GeneralSecurityException e) { throw new SecurityException("Failed to verify the signature for the provided request.", e); } } CEKRequestSignatureVerifier(Resource keyResource); @Override void verify(HttpServletRequest request, CEKRequestMessage requestMessage, String requestJson,
                       SystemContext system);  }### Answer:
@Test public void test_noHeader() throws Throwable { doCallRealMethod().when(advice).handle(captor.capture()); String body = CEKRequestGenerator.requestBodyBuilder("data/signature_test_request.json", objectMapper) .customize(bindIntentRequest()) .build(); mvc.perform(post("/cek/v1") .content(body) .contentType(MediaType.APPLICATION_JSON)) .andDo(print()) .andExpect(status().isBadRequest()); verify(handler, never()).handleSignatureVerificationTest(); assertThat(captor.getValue()).isExactlyInstanceOf(SecurityException.class) .hasMessage("SignatureCEK is missing."); }
@Test public void test_hasSignatureHeader_wrongSignature() throws Throwable { doCallRealMethod().when(advice).handle(captor.capture()); String body = CEKRequestGenerator.requestBodyBuilder("data/signature_test_request.json", objectMapper) .customize(bindIntentRequest()) .build(); mvc.perform(post("/cek/v1") .header(CLOVA_SIGNATURE_REQUEST_HEADER, RandomStringUtils.randomAlphabetic(10)) .content(body) .contentType(MediaType.APPLICATION_JSON)) .andDo(print()) .andExpect(status().isBadRequest()); verify(handler, never()).handleSignatureVerificationTest(); assertThat(captor.getValue()).isExactlyInstanceOf(SecurityException.class) .hasMessage("Failed to verify the signature for the provided request."); }
@Test public void test_hasSignatureHeader_correctSignature() throws Throwable { String signature = StreamUtils.copyToString(new ClassPathResource("data/signature").getInputStream(), StandardCharsets.UTF_8).trim(); String body = CEKRequestGenerator.requestBodyBuilder("data/signature_test_request.json", objectMapper) .customize(bindIntentRequest()) .build(); mvc.perform(post("/cek/v1") .header(CLOVA_SIGNATURE_REQUEST_HEADER, signature) .content(body) .contentType(MediaType.APPLICATION_JSON)) .andDo(print()) .andExpect(status().isOk()); verify(handler).handleSignatureVerificationTest(); }