(JavaScript) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Note

This example is intended for running within a Chilkat.Js embedded JavaScript engine. All Chilkat JavaScript examples require Chilkat v11.4.0 or greater.

var success = false;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed XML we wish to verify contains external references such as this:

//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//     </ds:Reference>
//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//     </ds:Reference>

var verifier = new CkXmlDSig();
var http = new CkHttp();

// First load the signed XML
var sbSignedXml = new CkStringBuilder();
success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8");
if (success == false) {
    console.log("Failed to load signed XML.");
    return;
}

success = verifier.LoadSignatureSb(sbSignedXml);
if (success == false) {
    console.log(verifier.LastErrorText);
    return;
}

// Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
var sbRefUri = new CkStringBuilder();
var bd = new CkBinData();
var numRefs = verifier.NumReferences;
var i = 0;
while (i < numRefs) {
    if (verifier.IsReferenceExternal(i) == true) {
        sbRefUri.Clear();
        sbRefUri.Append(verifier.ReferenceUri(i));
        if (sbRefUri.StartsWith("https://",false) == true) {
            console.log("External URL Reference: " + sbRefUri.GetAsString());

            // Download the data at the URL and provide to the verifier.
            success = http.DownloadBd(sbRefUri.GetAsString(),bd);
            if (success == false) {
                console.log(http.LastErrorText);
                return;
            }

            success = verifier.SetRefDataBd(i,bd);
            if (success == false) {
                console.log(verifier.LastErrorText);
                return;
            }

        }

    }

    i = i+1;
}

// Now that we have the external data, verify the signature..
var bVerified = verifier.VerifySignature(true);
if (bVerified == false) {
    console.log(verifier.LastErrorText);
}

console.log("Signature verified = " + bVerified);