Lua

Verify XML Signature with External URL References

See more XML Digital Signatures Examples

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server. Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

-- The signed XML we wish to verify contains external references such as this:

--     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
--       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
--       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
--     </ds:Reference>
--     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
--       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
--       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
--     </ds:Reference>

local verifier = chilkat.XmlDSig.new()
local http = chilkat.Http.new()

-- First load the signed XML
local sbSignedXml = chilkat.StringBuilder.new()
local success = sbSignedXml:load_file("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml", "utf-8")
if not success then
    print("Failed to load signed XML.")
    return
end

success = verifier:load_signature_sb(sbSignedXml)
if not success then
    print(verifier.last_error_text)
    return
end

-- Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
local sbRefUri = chilkat.StringBuilder.new()
local bd = chilkat.BinData.new()
local numRefs = verifier.num_references
local i = 0
while i < numRefs do
    if verifier:is_reference_external(i) then
        sbRefUri:clear()
        sbRefUri:append(verifier:reference_uri(i))
        if sbRefUri:starts_with("https://", false) then
            print("External URL Reference: " .. sbRefUri:get_as_string())

            -- Download the data at the URL and provide to the verifier.
            success = http:download_bd(sbRefUri:get_as_string(), bd)
            if not success then
                print(http.last_error_text)
                return
            end

            success = verifier:set_ref_data_bd(i, bd)
            if not success then
                print(verifier.last_error_text)
                return
            end
        end
    end

    i = i + 1
end

-- Now that we have the external data, verify the signature..
local bVerified = verifier:verify_signature(true)
if not bVerified then
    print(verifier.last_error_text)
end

print("Signature verified = " .. tostring(bVerified))