code: public static boolean check(String token, String signature, String timestamp, String nonce) {
          // 防范长密文攻击
          if (signature == null
              || signature.length() > 128
              || timestamp == null
              || timestamp.length() > 128
              || nonce == null
              || nonce.length() > 128) {
              log.warnf("bad check : signature=%s,timestamp=%s,nonce=%s",
                        signature,
                        timestamp,
                        nonce);
              return false;
          }
          ArrayList<String> tmp = new ArrayList<String>();
          tmp.add(token);
          tmp.add(timestamp);
          tmp.add(nonce);
          Collections.sort(tmp);
          String key = Lang.concat("", tmp).toString();
          return Lang.sha1(key).equalsIgnoreCase(signature);
      }
docs: 检查signature是否合法