Xbase++

Verify XML Signature with External URL References

See more XML Digital Signatures Examples

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server. Xbase++

LOCAL nSuccess
LOCAL oVerifier
LOCAL oHttp
LOCAL oSbSignedXml
LOCAL oSbRefUri
LOCAL oBd
LOCAL nNumRefs
LOCAL i
LOCAL nBVerified

nSuccess := 0

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  The signed XML we wish to verify contains external references such as this:

//      <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//        <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//      </ds:Reference>
//      <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//        <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//      </ds:Reference>

oVerifier := CreateObject("Chilkat.XmlDSig")
oHttp := CreateObject("Chilkat.Http")

//  First load the signed XML
oSbSignedXml := CreateObject("Chilkat.StringBuilder")
nSuccess := oSbSignedXml:LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml", "utf-8")
IF (nSuccess == 0)
    ? "Failed to load signed XML."
    oVerifier:destroy()
    oHttp:destroy()
    oSbSignedXml:destroy()
    RETURN
ENDIF

nSuccess := oVerifier:LoadSignatureSb(oSbSignedXml)
IF (nSuccess == 0)
    ? oVerifier:LastErrorText
    oVerifier:destroy()
    oHttp:destroy()
    oSbSignedXml:destroy()
    RETURN
ENDIF

//  Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
oSbRefUri := CreateObject("Chilkat.StringBuilder")
oBd := CreateObject("Chilkat.BinData")
nNumRefs := oVerifier:NumReferences
i := 0
DO WHILE i < nNumRefs
    IF (oVerifier:IsReferenceExternal(i) == 1)
        oSbRefUri:Clear()
        oSbRefUri:Append(oVerifier:ReferenceUri(i))
        IF (oSbRefUri:StartsWith("https://", 0) == 1)
            ? "External URL Reference: " + oSbRefUri:GetAsString()

            //  Download the data at the URL and provide to the verifier.
            nSuccess := oHttp:DownloadBd(oSbRefUri:GetAsString(), oBd)
            IF (nSuccess == 0)
                ? oHttp:LastErrorText
                oVerifier:destroy()
                oHttp:destroy()
                oSbSignedXml:destroy()
                oSbRefUri:destroy()
                oBd:destroy()
                RETURN
            ENDIF

            nSuccess := oVerifier:SetRefDataBd(i, oBd)
            IF (nSuccess == 0)
                ? oVerifier:LastErrorText
                oVerifier:destroy()
                oHttp:destroy()
                oSbSignedXml:destroy()
                oSbRefUri:destroy()
                oBd:destroy()
                RETURN
            ENDIF

        ENDIF

    ENDIF

    i := i + 1
ENDDO

//  Now that we have the external data, verify the signature..
nBVerified := oVerifier:VerifySignature(1)
IF (nBVerified == 0)
    ? oVerifier:LastErrorText
ENDIF

? "Signature verified = " + Str(nBVerified)

oVerifier:destroy()
oHttp:destroy()
oSbSignedXml:destroy()
oSbRefUri:destroy()
oBd:destroy()