djb-eapim/elink-online-common
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Body값이 "", Null, "{}" 일 경우와 Method가 GET/DELETE일 경우 signature-body 검증

Browse Source 
제외(by 이상욱D)
This commit is contained in:
Yunsam.Eo
2026-01-09 14:41:24 +09:00
parent 31146886bd
commit 9155ad51ff
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/eactive/eai/adapter/http/dynamic/filter/HmacSha256VerifyFilterKjb.java
+15 -6
View File
@@ -15,6 +15,7 @@ import javax.servlet.http.HttpServletResponse;
import org.springframework.http.HttpStatus; import org.springframework.http.HttpStatus;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import com.eactive.eai.adapter.http.HttpMethodType;
import com.eactive.eai.adapter.http.dynamic.HttpAdapterServiceKey; import com.eactive.eai.adapter.http.dynamic.HttpAdapterServiceKey;
import com.eactive.eai.adapter.http.dynamic.HttpAdapterServiceSupport; import com.eactive.eai.adapter.http.dynamic.HttpAdapterServiceSupport;
import com.eactive.eai.authserver.service.OAuth2Manager; import com.eactive.eai.authserver.service.OAuth2Manager;
@@ -43,8 +44,7 @@ public class HmacSha256VerifyFilterKjb implements HttpAdapterFilter {
String xObpSignatureUrl = request.getHeader("x-obp-signature-url"); String xObpSignatureUrl = request.getHeader("x-obp-signature-url");
String xObpSignatureBody = request.getHeader("x-obp-signature-body"); String xObpSignatureBody = request.getHeader("x-obp-signature-body");
if (StringUtils.isBlank(xObpPartnercode) if (StringUtils.isBlank(xObpPartnercode)
|| StringUtils.isBlank(xObpSignatureUrl) || StringUtils.isBlank(xObpSignatureUrl)) {
|| StringUtils.isBlank(xObpSignatureBody)) {
throw new JwtAuthException( throw new JwtAuthException(
String.valueOf(HttpStatus.UNAUTHORIZED.value()), String.valueOf(HttpStatus.UNAUTHORIZED.value()),
"Can not find mandatory Http Header"); "Can not find mandatory Http Header");
@@ -67,10 +67,19 @@ public class HmacSha256VerifyFilterKjb implements HttpAdapterFilter {
"Signature verifying failed : x-obp-signature-url"); "Signature verifying failed : x-obp-signature-url");
} }
if (!StringUtils.equals(xObpSignatureBody, macBody)) { switch (HttpMethodType.getValue(request.getMethod())) {
throw new JwtAuthException( case GET:
String.valueOf(HttpStatus.UNAUTHORIZED.value()), case DELETE:
"Signature verifying failed : x-obp-signature-body"); break;
default:
if (StringUtils.isNotBlank(inboundBody) && !StringUtils.equals("{}", inboundBody)) {
if (!StringUtils.equals(xObpSignatureBody, macBody)) {
throw new JwtAuthException(
String.valueOf(HttpStatus.UNAUTHORIZED.value()),
"Signature verifying failed : x-obp-signature-body");
}
break;
}
} }
} catch (JwtAuthException e) { } catch (JwtAuthException e) {