Decrypt a JWE to a String

See more JSON Web Encryption (JWE) Examples

Demonstrates Jwe.Decrypt, which decrypts a recipient of a loaded JWE and returns the plaintext, decoded using the given charset. Before decrypting, the example inspects the JWE protected header and, under application policy, accepts only permitted algorithms and selects an acceptable recipient.

load ./chilkat.dll

set success 0

set jwe [new_CkJwe]

#  Load the JWE compact serialization to be decrypted.
set jweCompact "eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.<...>.<iv>.<ciphertext>.<tag>"
set success [CkJwe_LoadJwe $jwe $jweCompact]
if {$success == 0} then {
    puts [CkJwe_lastErrorText $jwe]
    delete_CkJwe $jwe
    exit
}

#  Application policy: before decrypting, inspect the JWE header and accept only algorithms the
#  application trusts.  Never assume the algorithms in a received JWE are safe -- a sender could
#  specify a weak or unexpected algorithm.
set protHeader [new_CkJsonObject]

set success [CkJwe_GetProtectedHeader $jwe $protHeader]
if {$success == 0} then {
    puts [CkJwe_lastErrorText $jwe]
    delete_CkJwe $jwe
    delete_CkJsonObject $protHeader
    exit
}

#  Read the alg (key-management) and enc (content-encryption) header values into StringBuilder
#  objects so they can be compared.
set sbAlg [new_CkStringBuilder]

set success [CkJsonObject_StringOfSb $protHeader "alg" $sbAlg]
if {$success == 0} then {
    puts [CkJsonObject_lastErrorText $protHeader]
    delete_CkJwe $jwe
    delete_CkJsonObject $protHeader
    delete_CkStringBuilder $sbAlg
    exit
}

set sbEnc [new_CkStringBuilder]

set success [CkJsonObject_StringOfSb $protHeader "enc" $sbEnc]
if {$success == 0} then {
    puts [CkJsonObject_lastErrorText $protHeader]
    delete_CkJwe $jwe
    delete_CkJsonObject $protHeader
    delete_CkStringBuilder $sbAlg
    delete_CkStringBuilder $sbEnc
    exit
}

puts "JWE algorithms: alg=[CkStringBuilder_getAsString $sbAlg] enc=[CkStringBuilder_getAsString $sbEnc]"

#  Enforce an allowlist of acceptable algorithms.  Reject anything not permitted by policy.  String
#  values are compared using StringBuilder.ContentsEqual.
set bCaseSensitive 1
if {[CkStringBuilder_ContentsEqual $sbAlg "A256KW" $bCaseSensitive] != 1} then {
    puts "Rejecting JWE: key-management algorithm is not permitted by policy."
    delete_CkJwe $jwe
    delete_CkJsonObject $protHeader
    delete_CkStringBuilder $sbAlg
    delete_CkStringBuilder $sbEnc
    exit
}

if {[CkStringBuilder_ContentsEqual $sbEnc "A256GCM" $bCaseSensitive] != 1} then {
    puts "Rejecting JWE: content-encryption algorithm is not permitted by policy."
    delete_CkJwe $jwe
    delete_CkJsonObject $protHeader
    delete_CkStringBuilder $sbAlg
    delete_CkStringBuilder $sbEnc
    exit
}

#  Select an acceptable recipient.  For a multi-recipient JWE, FindRecipient locates the recipient
#  this application holds a key for by a per-recipient header value such as "kid".  A compact JWE
#  has a single recipient at index 0, so FindRecipient returns -1; fall back to index 0 in that case.
set recipientIndex [CkJwe_FindRecipient $jwe "kid" "recipient-key-1" $bCaseSensitive]
if {$recipientIndex < 0} then {
    set recipientIndex 0
}

#  Provide the key for the selected recipient.  In production, obtain the key from a secure source
#  rather than hard-coding it.
set base64Key "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU="
set success [CkJwe_SetWrappingKey $jwe $recipientIndex $base64Key "base64"]
if {$success == 0} then {
    puts [CkJwe_lastErrorText $jwe]
    delete_CkJwe $jwe
    delete_CkJsonObject $protHeader
    delete_CkStringBuilder $sbAlg
    delete_CkStringBuilder $sbEnc
    exit
}

#  Decrypt the selected recipient and return the plaintext, decoded using the given charset.
set content [CkJwe_decrypt $jwe $recipientIndex "utf-8"]
if {[CkJwe_get_LastMethodSuccess $jwe] == 0} then {
    puts [CkJwe_lastErrorText $jwe]
    delete_CkJwe $jwe
    delete_CkJsonObject $protHeader
    delete_CkStringBuilder $sbAlg
    delete_CkStringBuilder $sbEnc
    exit
}

puts "$content"

delete_CkJwe $jwe
delete_CkJsonObject $protHeader
delete_CkStringBuilder $sbAlg
delete_CkStringBuilder $sbEnc