Method for Verifying the Signature in the Response for Sign-in Signature Verification

During an API call, the requester may receive a response that contains a signature string from the recipient. In this case, the requester can verify the signature string in order to check if the response has been tampered with. This helps secure the API call.

1. Obtain the signature string in the returned result, that is, the rtnSign field returned by the sign-in signature verification API.
2. Sort the rtnCode and ts parameters in ascending order according to the ASCII codes of the initial letters of their names.
3. Use an ampersand (&) to splice the sorted parameters included in the signature and their values to a string using the key-value pair format, for example, "rtnCode=xxxxxx&ts=xxxxxxx".
   

   Note the following when splicing the string:

   • Parameter names and values must not be URL encoded.
   • Parameter values must be the same as those in the response.
4. Verify the string that is generated and the string that is returned by using the Game Service public key.
   

   The public key of a game is generated after Game Service is enabled for the game. For details about how to query the public key, please refer to Querying Game Service Information.

   Java sample code:

   /** 
    * Verify signature information.
    * @param  content  String to be verified.
    * @param sign  Signature string.
    * @param publicKey  Public key.
    * @param signType  Encryption type.
    * @param Whether the verification is successful.
   */
   public static boolean doCheck(String content, String sign, String publicKey, String signtype) {
      try {
         KeyFactory keyFactory = KeyFactory.getInstance("RSA");
         byte[] encodedKey = decoder.decode(publicKey);
         PublicKey pubKey = keyFactory.generatePublic(new X509EncodedKeySpec(encodedKey));
         java.security.Signature signature = null;
         if ("RSA256".equals(signtype)) {
           signature = java.security.Signature.getInstance(SIGN_ALGORITHMS256);
         } else {
           signature = java.security.Signature.getInstance(SIGN_ALGORITHMS);
         }       
         signature.initVerify(pubKey);
         signature.update(content.getBytes("utf-8"));
         boolean bverify = signature.verify(decoder.decode(sign));
         return bverify;
      } catch (Exception e) {
         e.printStackTrace();
      }
      return false;
   }