Rewrite example

Author: Rabsztok

README.md

@@ -336,29 +336,6 @@ You can find the [Mailtrap Java API reference](https://mailtrap.github.io/mailtr
 - [Webhooks](examples/java/io/mailtrap/examples/webhooks/WebhooksExample.java)
 - [Verifying webhook signatures](examples/java/io/mailtrap/examples/webhooks/WebhookSignatureExample.java)
 
-#### Verifying webhook signatures
-
-Mailtrap signs every outbound webhook with HMAC-SHA256 and sends the lowercase hex digest in the `Mailtrap-Signature` header. Verify the signature against the raw request body using the `signing_secret` returned when you created the webhook:
-
-```java
-import io.mailtrap.webhooks.WebhookSignatures;
-
-// `payload` must be the unparsed request body — do NOT re-serialize the
-// parsed JSON, as that may reorder keys and invalidate the signature.
-boolean valid = WebhookSignatures.verify(
-    payload,
-    request.getHeader("Mailtrap-Signature"),
-    System.getenv("MAILTRAP_WEBHOOK_SIGNING_SECRET")
-);
-
-if (!valid) {
-    // reject the request — 401 Unauthorized
-    return;
-}
-```
-
-The helper performs a constant-time comparison and returns `false` (rather than throwing) for empty, missing, or malformed signatures.
-
 ### Organizations API
 
 - [Sub-Accounts](examples/java/io/mailtrap/examples/organizations/SubAccountsExample.java)

examples/java/io/mailtrap/examples/webhooks/WebhookSignatureExample.java

@@ -1,26 +1,37 @@
 package io.mailtrap.examples.webhooks;
 
+import com.sun.net.httpserver.HttpServer;
 import io.mailtrap.webhooks.WebhookSignatures;
 
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.InetSocketAddress;
 import java.nio.charset.StandardCharsets;
-import java.util.HexFormat;
 
 public class WebhookSignatureExample {
 
-    public static void main(final String[] args) throws Exception {
-        // --- Direct verification (e.g. for unit tests or custom routers) ----
-        final String payload = "{\"event\":\"delivery\",\"message_id\":\"abc-123\"}";
-        final String signingSecret = "8d9a3c0e7f5b2d4a6c1e9f8b3a7d5c2e";
+    public static void main(final String[] args) throws IOException {
+        final String signingSecret = System.getenv("MAILTRAP_WEBHOOK_SIGNING_SECRET");
 
-        final Mac mac = Mac.getInstance("HmacSHA256");
-        mac.init(new SecretKeySpec(signingSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
-        final String signature = HexFormat.of().formatHex(
-            mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));
+        final HttpServer server = HttpServer.create(new InetSocketAddress(9292), 0);
+        server.createContext("/webhooks/mailtrap", exchange -> {
+            // Use the raw request body — parsing and re-serializing the JSON may
+            // reorder keys or alter whitespace and invalidate the signature.
+            final String payload;
+            try (InputStream body = exchange.getRequestBody()) {
+                payload = new String(body.readAllBytes(), StandardCharsets.UTF_8);
+            }
+            final String signature = exchange.getRequestHeaders().getFirst("Mailtrap-Signature");
 
-        if (!WebhookSignatures.verify(payload, signature, signingSecret)) {
-            throw new IllegalStateException("Signature verification failed!");
-        }
+            if (!WebhookSignatures.verify(payload, signature, signingSecret)) {
+                exchange.sendResponseHeaders(401, -1);
+                exchange.close();
+                return;
+            }
+
+            exchange.sendResponseHeaders(200, -1);
+            exchange.close();
+        });
+        server.start();
     }
 }