public boolean verify(GoogleIdToken googleIdToken) throws GeneralSecurityException, IOException { // check the payload if (!super.verify(googleIdToken)) { return false; } // verify signature for (PublicKey publicKey : publicKeys.getPublicKeys()) { try { if (googleIdToken.verifySignature(publicKey)) { return true; } } catch (Exception e) { System.err.println("Verify Token:" + e); } } return false; }
if (googleIdToken.verifySignature(publicKey)) { return true;
/** * Verifies that the given ID token is valid using the cached public keys. * * It verifies: * * <ul> * <li>The RS256 signature, which uses RSA and SHA-256 based on the public keys downloaded from * the public certificate endpoint.</li> * <li>The current time against the issued at and expiration time (allowing for a 5 minute clock * skew).</li> * <li>The issuer is {@code "accounts.google.com"} or {@code "https://accounts.google.com"}.</li> * </ul> * * @param googleIdToken Google ID token * @return {@code true} if verified successfully or {@code false} if failed */ public boolean verify(GoogleIdToken googleIdToken) throws GeneralSecurityException, IOException { // check the payload if (!super.verify(googleIdToken)) { return false; } // verify signature, try all public keys in turn. for (PublicKey publicKey : publicKeys.getPublicKeys()) { if (googleIdToken.verifySignature(publicKey)) { return true; } } return false; }
if (googleIdToken.verifySignature(publicKey)) { log.info("verifySignature: success!"); return true;