Decrypt a JWE to a String

See more JSON Web Encryption (JWE) Examples

Demonstrates Jwe.Decrypt, which decrypts a recipient of a loaded JWE and returns the plaintext, decoded using the given charset. Before decrypting, the example inspects the JWE protected header and, under application policy, accepts only permitted algorithms and selects an acceptable recipient.

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Jwe,
  Chilkat.StringBuilder,
  Chilkat.JsonObject;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  jwe: TJwe;
  jweCompact: string;
  protHeader: TJsonObject;
  sbAlg: TStringBuilder;
  sbEnc: TStringBuilder;
  bCaseSensitive: Boolean;
  recipientIndex: Integer;
  base64Key: string;
  content: string;

begin
  success := False;

  jwe := TJwe.Create;

  //  Load the JWE compact serialization to be decrypted.
  jweCompact := 'eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.<...>.<iv>.<ciphertext>.<tag>';
  success := jwe.LoadJwe(jweCompact);
  if (success = False) then
    begin
      WriteLn(jwe.LastErrorText);
      Exit;
    end;

  //  Application policy: before decrypting, inspect the JWE header and accept only algorithms the
  //  application trusts.  Never assume the algorithms in a received JWE are safe -- a sender could
  //  specify a weak or unexpected algorithm.
  protHeader := TJsonObject.Create;
  success := jwe.GetProtectedHeader(protHeader);
  if (success = False) then
    begin
      WriteLn(jwe.LastErrorText);
      Exit;
    end;

  //  Read the alg (key-management) and enc (content-encryption) header values into StringBuilder
  //  objects so they can be compared.
  sbAlg := TStringBuilder.Create;
  success := protHeader.StringOfSb('alg',sbAlg);
  if (success = False) then
    begin
      WriteLn(protHeader.LastErrorText);
      Exit;
    end;
  sbEnc := TStringBuilder.Create;
  success := protHeader.StringOfSb('enc',sbEnc);
  if (success = False) then
    begin
      WriteLn(protHeader.LastErrorText);
      Exit;
    end;
  WriteLn('JWE algorithms: alg=' + sbAlg.GetAsString() + ' enc=' + sbEnc.GetAsString());

  //  Enforce an allowlist of acceptable algorithms.  Reject anything not permitted by policy.  String
  //  values are compared using StringBuilder.ContentsEqual.
  bCaseSensitive := True;
  if (sbAlg.ContentsEqual('A256KW',bCaseSensitive) <> True) then
    begin
      WriteLn('Rejecting JWE: key-management algorithm is not permitted by policy.');
      Exit;
    end;
  if (sbEnc.ContentsEqual('A256GCM',bCaseSensitive) <> True) then
    begin
      WriteLn('Rejecting JWE: content-encryption algorithm is not permitted by policy.');
      Exit;
    end;

  //  Select an acceptable recipient.  For a multi-recipient JWE, FindRecipient locates the recipient
  //  this application holds a key for by a per-recipient header value such as "kid".  A compact JWE
  //  has a single recipient at index 0, so FindRecipient returns -1; fall back to index 0 in that case.
  recipientIndex := jwe.FindRecipient('kid','recipient-key-1',bCaseSensitive);
  if (recipientIndex < 0) then
    begin
      recipientIndex := 0;
    end;

  //  Provide the key for the selected recipient.  In production, obtain the key from a secure source
  //  rather than hard-coding it.
  base64Key := 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU=';
  success := jwe.SetWrappingKey(recipientIndex,base64Key,'base64');
  if (success = False) then
    begin
      WriteLn(jwe.LastErrorText);
      Exit;
    end;

  //  Decrypt the selected recipient and return the plaintext, decoded using the given charset.
  content := jwe.Decrypt(recipientIndex,'utf-8');
  if (jwe.LastMethodSuccess = False) then
    begin
      WriteLn(jwe.LastErrorText);
      Exit;
    end;
  WriteLn(content);


  jwe.Free;
  protHeader.Free;
  sbAlg.Free;
  sbEnc.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.