Bug fix on SpeechletRequestSignatureVerifier

alexa · Feb 6, 2016 · 7411ac4 · 7411ac4
1 parent b58bfa6
commit 7411ac4
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/com/amazon/speech/speechlet/authentication/SpeechletRequestSignatureVerifier.java b/src/com/amazon/speech/speechlet/authentication/SpeechletRequestSignatureVerifier.java
@@ -90,8 +90,11 @@ public static void checkRequestSignature(final byte[] serializedSpeechletRequest
             Signature signature = Signature.getInstance(Sdk.SIGNATURE_ALGORITHM);
             signature.initVerify(signingCertificate.getPublicKey());
             signature.update(serializedSpeechletRequest);
-            signature.verify(Base64.decodeBase64(baseEncoded64Signature
-                    .getBytes(Sdk.CHARACTER_ENCODING)));
+            if (!signature.verify(Base64.decodeBase64(baseEncoded64Signature
+                    .getBytes(Sdk.CHARACTER_ENCODING)))) {
+                throw new SecurityException(
+                        "Failed to verify the signature/certificate for the provided speechlet request");
+            }
         } catch (CertificateException | SignatureException | NoSuchAlgorithmException
                 | InvalidKeyException | IOException ex) {
             throw new SecurityException(