code: private static boolean verifySignature(String content, String secret, String signature) throws InvalidTokenException{
          try {
              SecretKey secretKey = new SecretKeySpec(secret.getBytes(), ALG_HMACSHA256);
              Mac mac = Mac.getInstance(ALG_HMACSHA256);
              mac.init(secretKey);
              byte[] bytes = mac.doFinal(content.getBytes());
              String base64 = base64UrlEncode(bytes);
              return  Strings.equals(base64,signature);
          } catch (Exception e) {
              throw new RuntimeException("Verify signature error", e);
          }
      }
docs: 基于HS256算法验证
  @throws InvalidTokenException 如果签名的格式不正确