diff --git a/src/main/java/com/eactive/eai/rms/ext/djb/webhook/controller/WebhookSendController.java b/src/main/java/com/eactive/eai/rms/ext/djb/webhook/controller/WebhookSendController.java index ec74eae..f764366 100644 --- a/src/main/java/com/eactive/eai/rms/ext/djb/webhook/controller/WebhookSendController.java +++ b/src/main/java/com/eactive/eai/rms/ext/djb/webhook/controller/WebhookSendController.java @@ -60,7 +60,7 @@ public class WebhookSendController { * X-Webhook-Signature : sha256={hmac값} * X-Webhook-Event : ORDER_CREATED * X-Webhook-Timestamp : 1712345678901 - */ + @PostMapping("/receive") public ResponseEntity> receiveWebhook( @RequestHeader(value = "x-webhook-signature", required = false) String signature, @@ -80,12 +80,14 @@ public class WebhookSendController { } // 2. 서명 검증 - boolean isValid = webhookReceiveService.verifySignature(rawPayload, signature, ""); - if (!isValid) { - log.warn("[Webhook] 수신 거부 - 서명 불일치 / eventType: {}", eventType); - return ResponseEntity - .status(HttpStatus.UNAUTHORIZED) - .body(errorResponse("서명 검증에 실패하였습니다.")); + Boolean isValid = webhookReceiveService.verifySignature(rawPayload, signature, ""); + if (isValid != null) { + if (!isValid) { + log.warn("[Webhook] 수신 거부 - 서명 불일치 / eventType: {}", eventType); + return ResponseEntity + .status(HttpStatus.UNAUTHORIZED) + .body(errorResponse("서명 검증에 실패하였습니다.")); + } } // 3. 타임스탬프 유효성 검증 (5분 이내 요청만 허용) @@ -114,6 +116,7 @@ public class WebhookSendController { return ResponseEntity.ok(response); } + */ /* ------------------------------------------------------------------ */ /* 공통 */