Spring (Java)

Java (Spring)

Installation

Add the dependency:

<dependency>
    <groupId>com.botbye</groupId>
    <artifactId>java-module</artifactId>
    <version>3.0.1</version>
</dependency>

Configuration

Expose the dedicated BotbyePhishingClient as a Spring bean. Phishing is separate from the evaluate Botbye client and is identified by a public, browser-safe clientKey, so it needs no server key. On construction it makes a one-off, best-effort server-integration init handshake that reports this server-side integration to BotBye; it is non-blocking, so expose it as a singleton bean and reuse it.

BotbyePhishingConfig takes 2 values: endpoint (optional, defaults to https://verify.botbye.com) and clientKey.

Getting clientKey

clientKey is the public, browser-safe identifier of your phishing project. It travels in the asset URL path, so it is safe to expose — no secret token and no Base64 encoding are required.

Find it on the Get Started screen of your phishing project in the BotBye dashboard.

import com.botbye.phishing.BotbyePhishingClient;
import com.botbye.phishing.BotbyePhishingConfig;

@Configuration
public class AppConfig {

    @Bean
    public BotbyePhishingClient phishingClient() {
        return new BotbyePhishingClient(
                new BotbyePhishingConfig.Builder()
                        .endpoint("https://verify.botbye.com")
                        .clientKey("<public-client-key>")
                        .build()
        );
    }
}

Usage

Expose a single endpoint that proxies phishing pixel requests.

When you use an SVG image, your application must also expose an endpoint on the client origin that handles requests to /{imageId}.png, where imageId is the value that arrives in the forwarded pixel query as image_id.

@RestController
@RequestMapping("/api/phishing")
public class PhishingController {
    private final BotbyePhishingClient phishing;

    @Autowired
    public PhishingController(BotbyePhishingClient phishing) {
        this.phishing = phishing;
    }

    @GetMapping("/image")
    public ResponseEntity<byte[]> image(
            @RequestHeader(name = "Origin", required = false) String origin,
            @RequestParam Map<String, String> params
    ) {
        BotbyePhishingResponse response = phishing.fetchImage(origin, params);

        if (response.getError() != null) {
            return ResponseEntity.status(502).body(null);
        }

        String contentType = response.getHeaders().getOrDefault("Content-Type", "image/png");

        return ResponseEntity
                .status(response.getStatus())
                .contentType(MediaType.valueOf(contentType))
                .body(response.getBody());
    }
}

Settings

Configuration parameters for phishing integration:

Setting	Description	Required	Default Value
endpoint	Host of the phishing API	no	https://verify.botbye.com
clientKey	Public client-key of your phishing project	yes	-