Pascal (Lazarus/Delphi)

Validate the at_hash Claim of an ID Token

See more JSON Web Token (JWT) Examples

Demonstrates how to hash an access token to compare it with the at_hash claim of an ID token. Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.BinData,
  Chilkat.Jwt,
  Chilkat.JsonObject,
  Chilkat.Crypt2;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  jsonToken: TJsonObject;
  jwt: TJwt;
  idToken: string;
  jose: string;
  jsonHeader: TJsonObject;
  claims: string;
  jsonClaims: TJsonObject;
  token_to_hash: string;
  token_hash_expected: string;
  crypt: TCrypt2;
  bdHash: TBinData;
  sz: Integer;
  token_hash_computed: string;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  This example uses a Google access_token + id_token that looks like this:

  //   {
  //    "access_token": "ya29.a0...0f",
  //    "expires_in": 3599,
  //    "scope": "openid https://www.googleapis.com/auth/userinfo.email",
  //    "token_type": "Bearer",
  //    "id_token": "eyJhb...o5nQ"
  //  }

  jsonToken := TJsonObject.Create;
  success := jsonToken.LoadFile('qa_data/tokens/google_sample_id_token.json');
  if (success = False) then
    begin
      WriteLn('Failed to load the JSON file...');
      Exit;
    end;

  //  Use Chilkat's JWT API to examine the id_token..
  jwt := TJwt.Create;
  idToken := jsonToken.StringOf('id_token');

  //  Extract the JOSE header..
  jose := jwt.GetHeader(idToken);

  jsonHeader := TJsonObject.Create;
  jsonHeader.Load(jose);
  jsonHeader.EmitCompact := False;
  WriteLn(jsonHeader.Emit());

  //  The JOSE header looks like this:

  //  {
  //    "alg": "RS256",
  //    "kid": "e8799db06287515556213c80acbcfd022fb302a9",
  //    "typ": "JWT"
  //  }

  claims := jwt.GetPayload(idToken);

  jsonClaims := TJsonObject.Create;
  jsonClaims.Load(claims);
  jsonClaims.EmitCompact := False;
  WriteLn(jsonClaims.Emit());

  //  The claims look like this:

  //  {
  //    "iss": "https://accounts.google.com",
  //    "azp": "258999997753-5ni8lu5f15r7mno97d82f5lir9i9f6i1.apps.googleusercontent.com",
  //    "aud": "258999997753-5ni8lu5f15r7mno97d82f5lir9i9f6i1.apps.googleusercontent.com",
  //    "sub": "111787341816486547572",
  //    "email": "somebody@gmail.com",
  //    "email_verified": true,
  //    "at_hash": "HYJZImlW3mUK-UfjRfXjKw",
  //    "iat": 1615315968,
  //    "exp": 1615319568
  //  }

  //  The at_hash is the Access Token hash value. Its value is the base64url encoding of the
  //  left-most half of the hash of the octets of the ASCII representation of the access_token value,
  //  where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the
  //  ID Token's JOSE Header. For instance, if the alg is RS256, hash the access_token value with SHA-256,
  //  then take the left-most 128 bits and base64url encode them. The at_hash value is a case sensitive string.

  token_to_hash := jsonToken.StringOf('access_token');
  token_hash_expected := jsonClaims.StringOf('at_hash');

  //  Step 1. hashes the access token using SHA-256 (Google uses `RS256` as the ID Token `alg`).
  crypt := TCrypt2.Create;
  bdHash := TBinData.Create;

  crypt.HashAlgorithm := 'sha256';
  //  This encoding mode must match the encoding mode passed in the 2nd arg to AppendEncoded.
  //  The encoding mode can be anything, as long as they are the same in both places.
  crypt.EncodingMode := 'hex';

  success := bdHash.AppendEncoded(crypt.HashStringENC(token_to_hash),'hex');
  sz := bdHash.NumBytes;

  token_hash_computed := bdHash.GetEncodedChunk(0,sz / 2,'base64url');

  //  If the hashes are identical, then the access_token as issued for the given id_token.
  WriteLn('token_hash_expected: ' + token_hash_expected);
  WriteLn('token_hash_computed: ' + token_hash_computed);


  jsonToken.Free;
  jwt.Free;
  jsonHeader.Free;
  jsonClaims.Free;
  crypt.Free;
  bdHash.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.