@Test
public void testShouldFailIfSignedMessageWasChanged() throws Exception {

  RewardedAdsVerifier verifier =
      new RewardedAdsVerifier.Builder()
          .setVerifyingPublicKeys(GOOGLE_VERIFYING_PUBLIC_KEYS_JSON)
          .build();
  byte[] validSignedUrl =
      signUrl(REWARD_URL, GOOGLE_SIGNING_PRIVATE_KEY_PKCS8_BASE64, KEY_ID).getBytes(UTF_8);
  for (int i = REWARD_HOST_AND_PATH.length(); i < REWARD_URL.length(); i++) {
    byte[] modifiedUrl = Arrays.copyOf(validSignedUrl, validSignedUrl.length);
    modifiedUrl[i] = (byte) (modifiedUrl[i] ^ 0xff);
    try {
      verifier.verify(new String(modifiedUrl, UTF_8));
      fail("Expected GeneralSecurityException");
    } catch (GeneralSecurityException e) {
      assertEquals("Invalid signature", e.getMessage());
    }
  }
}