code: public static boolean verify(String appId, String appSecretKey, byte[] body, HttpServletRequest request)
              throws IOException {
          HmacSignatureBuilder builder = new HmacSignatureBuilder();
  
          String signitSignature = request.getHeader("X-Signit-Signature");
          builder.scheme(request.getHeader("X-Signit-Scheme"))
                  .apiKey(appId)
                  .apiSecret(appSecretKey.getBytes())
                  .method(request.getMethod()
                          .toUpperCase())
                  .payload(body)
                  .contentType(request.getContentType())
                  .host(Validator.isEmpty(request.getHeader("X-Signit-Host")) ? "" : request.getHeader("X-Signit-Host"))
                  .resource(Validator.isEmpty(request.getHeader("X-Signit-Resource")) ? ""
                          : request.getHeader("X-Signit-Resource"))
                  .nonce(Validator.isEmpty(request.getHeader("X-Signit-Nonce")) ? ""
                          : request.getHeader("X-Signit-Nonce"))
                  .date(Validator.isEmpty(request.getHeader("X-Signit-Date")) ? "" : request.getHeader("X-Signit-Date"));
          String selfBuiltHmac = builder.getDefaultAlgorithm() + " " + appId + ":" + builder.buildAsBase64();
          return selfBuiltHmac.equals(signitSignature);
      }
docs: 客户端验证服务器的webhook响应数据
  
  @param appId
  APP ID
  
  @param appSecretKey
  APP Secret
  @param body
  webhook响应具体数据。考虑到request中只能获取到body一次，故而需要在方法外获取并传递给此方法
  @param request
  服务端向客户端发起的请求
  @throws IOException
  数据流异常
  @return 验证结果： true-是服务器发送给客户端的数据；false-验证失败
  @since 2.0.0