DataFlex

Decrypt a JWE to a String

See more JSON Web Encryption (JWE) Examples

Demonstrates Jwe.Decrypt, which decrypts a recipient of a loaded JWE and returns the plaintext, decoded using the given charset. Before decrypting, the example inspects the JWE protected header and, under application policy, accepts only permitted algorithms and selects an acceptable recipient.

Background. A received JWE should never be trusted to specify safe algorithms. The example reads the alg and enc values from the protected header (via GetProtectedHeader) and enforces an allowlist, rejecting anything not permitted. It then selects the recipient the application holds a key for — using FindRecipient to locate a recipient by a per-recipient header value such as kid, falling back to index 0 for a single-recipient compact JWE — and only then supplies the key and decrypts.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoJwe
    String sJweCompact
    Variant vProtHeader
    Handle hoProtHeader
    Variant vSbAlg
    Handle hoSbAlg
    Variant vSbEnc
    Handle hoSbEnc
    Boolean iBCaseSensitive
    Integer iRecipientIndex
    String sBase64Key
    String sContent
    String sTemp1
    String sTemp2
    Boolean bTemp1

    Move False To iSuccess

    Get Create (RefClass(cComChilkatJwe)) To hoJwe
    If (Not(IsComObjectCreated(hoJwe))) Begin
        Send CreateComObject of hoJwe
    End

    //  Load the JWE compact serialization to be decrypted.
    Move "eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.<...>.<iv>.<ciphertext>.<tag>" To sJweCompact
    Get ComLoadJwe Of hoJwe sJweCompact To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoJwe To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Application policy: before decrypting, inspect the JWE header and accept only algorithms the
    //  application trusts.  Never assume the algorithms in a received JWE are safe -- a sender could
    //  specify a weak or unexpected algorithm.
    Get Create (RefClass(cComChilkatJsonObject)) To hoProtHeader
    If (Not(IsComObjectCreated(hoProtHeader))) Begin
        Send CreateComObject of hoProtHeader
    End
    Get pvComObject of hoProtHeader to vProtHeader
    Get ComGetProtectedHeader Of hoJwe vProtHeader To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoJwe To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Read the alg (key-management) and enc (content-encryption) header values into StringBuilder
    //  objects so they can be compared.
    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbAlg
    If (Not(IsComObjectCreated(hoSbAlg))) Begin
        Send CreateComObject of hoSbAlg
    End
    Get pvComObject of hoSbAlg to vSbAlg
    Get ComStringOfSb Of hoProtHeader "alg" vSbAlg To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoProtHeader To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbEnc
    If (Not(IsComObjectCreated(hoSbEnc))) Begin
        Send CreateComObject of hoSbEnc
    End
    Get pvComObject of hoSbEnc to vSbEnc
    Get ComStringOfSb Of hoProtHeader "enc" vSbEnc To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoProtHeader To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComGetAsString Of hoSbAlg To sTemp1
    Get ComGetAsString Of hoSbEnc To sTemp2
    Showln "JWE algorithms: alg=" sTemp1 " enc=" sTemp2

    //  Enforce an allowlist of acceptable algorithms.  Reject anything not permitted by policy.  String
    //  values are compared using StringBuilder.ContentsEqual.
    Move True To iBCaseSensitive
    Get ComContentsEqual Of hoSbAlg "A256KW" iBCaseSensitive To bTemp1
    If (bTemp1 <> True) Begin
        Showln "Rejecting JWE: key-management algorithm is not permitted by policy."
        Procedure_Return
    End

    Get ComContentsEqual Of hoSbEnc "A256GCM" iBCaseSensitive To bTemp1
    If (bTemp1 <> True) Begin
        Showln "Rejecting JWE: content-encryption algorithm is not permitted by policy."
        Procedure_Return
    End

    //  Select an acceptable recipient.  For a multi-recipient JWE, FindRecipient locates the recipient
    //  this application holds a key for by a per-recipient header value such as "kid".  A compact JWE
    //  has a single recipient at index 0, so FindRecipient returns -1; fall back to index 0 in that case.
    Get ComFindRecipient Of hoJwe "kid" "recipient-key-1" iBCaseSensitive To iRecipientIndex
    If (iRecipientIndex < 0) Begin
        Move 0 To iRecipientIndex
    End

    //  Provide the key for the selected recipient.  In production, obtain the key from a secure source
    //  rather than hard-coding it.
    Move "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU=" To sBase64Key
    Get ComSetWrappingKey Of hoJwe iRecipientIndex sBase64Key "base64" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoJwe To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Decrypt the selected recipient and return the plaintext, decoded using the given charset.
    Get ComDecrypt Of hoJwe iRecipientIndex "utf-8" To sContent
    Get ComLastMethodSuccess Of hoJwe To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoJwe To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln sContent


End_Procedure