SQL Server

Verify JWT Using an RSA Public Key (RS256, RS384, RS512)

See more JSON Web Token (JWT) Examples

Demonstrates how to verify a JWT that was signed using an RSA private key.

This example verifies the RSA signature. It also does the following:

• Checks to see if the time constraints ("nbf" and "exp") are valid.
• Recovers the original JOSE header.
• Recovers the original claims JSON.

SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    -- Demonstrates how to verify an JWT using an RSA public key.

    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @pubKey int
    EXEC @hr = sp_OACreate 'Chilkat.PublicKey', @pubKey OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OAMethod @pubKey, 'LoadFromFile', @success OUT, 'qa_data/pem/rsa_public.pem'

    DECLARE @jwt int
    EXEC @hr = sp_OACreate 'Chilkat.Jwt', @jwt OUT

    DECLARE @token nvarchar(4000)
    SELECT @token = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vZXhhbXBsZS5vcmciLCJzdWIiOiJKb2huIiwiYXVkIjoiaHR0cDovL2V4YW1wbGUuY29tIiwiaWF0IjoxNDYzNDQ1MjM4LCJuYmYiOjE0NjM0NDUyMzgsImV4cCI6MTQ2MzQ0ODgzOH0.XRtqed6nuJ9lrp0wbNdDX3fCkSh_d9cHAniPbNcqm7G-5N3mtI5ntQvZBDP3pHtECVqufuDwW7XgUtzAi0ZXhyiRm1iZ3wMSN5lHWv52OQJmMHPA7VPd8Q1hDG-tx-QswzJKd75OEUHP7wIXq2Mg_YVElfDvJI6TGjGyS1y-RLHlz-ldlGsEwIBkO0PtzIYTVov97x8p9KCsPNhS4lZUIqKOYoTZUV5LpuAWARl-636DfMEB_A5_IEaw_W8leh2suP2ULVZxwE-Tk1kBC9tsSGrBrPTtg7sziaV4Lbb0JRANmh98uTRu5f8ji9CVOnpbMiAzjsJSy56kz_olweXSuA'

    -- First verify the signature.
    DECLARE @sigVerified int
    EXEC sp_OAMethod @jwt, 'VerifyJwtPk', @sigVerified OUT, @token, @pubKey

    PRINT 'verified: ' + @sigVerified

    -- Let's see if the time constraints, if any, are valid.
    -- The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
    -- If the current system time is before the "nbf" time, or after the "exp" time,
    -- then IsTimeValid will return false/0.
    -- Also, we'll allow a leeway of 60 seconds to account for any clock skew.
    -- Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
    DECLARE @leeway int
    SELECT @leeway = 60
    DECLARE @bTimeValid int
    EXEC sp_OAMethod @jwt, 'IsTimeValid', @bTimeValid OUT, @token, @leeway

    PRINT 'time constraints valid: ' + @bTimeValid

    -- Now let's recover the original claims JSON (the payload).
    DECLARE @payload nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetPayload', @payload OUT, @token
    -- The payload will likely be in compact form:

    PRINT @payload

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    DECLARE @json int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT

    EXEC sp_OAMethod @json, 'Load', @success OUT, @payload
    EXEC sp_OASetProperty @json, 'EmitCompact', 0
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    -- We can recover the original JOSE header in the same way:
    DECLARE @joseHeader nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetHeader', @joseHeader OUT, @token
    -- The payload will likely be in compact form:

    PRINT @joseHeader

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    EXEC sp_OAMethod @json, 'Load', @success OUT, @joseHeader
    EXEC sp_OASetProperty @json, 'EmitCompact', 0
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    EXEC @hr = sp_OADestroy @pubKey
    EXEC @hr = sp_OADestroy @jwt
    EXEC @hr = sp_OADestroy @json


END
GO