(Delphi DLL) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Http, StringBuilder, BinData, XmlDSig;

...

procedure TForm1.Button1Click(Sender: TObject);
var
verifier: HCkXmlDSig;
http: HCkHttp;
sbSignedXml: HCkStringBuilder;
success: Boolean;
sbRefUri: HCkStringBuilder;
bd: HCkBinData;
numRefs: Integer;
i: Integer;
bVerified: Boolean;

begin
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed XML we wish to verify contains external references such as this:

//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//     </ds:Reference>
//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//     </ds:Reference>

verifier := CkXmlDSig_Create();
http := CkHttp_Create();

// First load the signed XML
sbSignedXml := CkStringBuilder_Create();
success := CkStringBuilder_LoadFile(sbSignedXml,'qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml','utf-8');
if (success = False) then
  begin
    Memo1.Lines.Add('Failed to load signed XML.');
    Exit;
  end;

success := CkXmlDSig_LoadSignatureSb(verifier,sbSignedXml);
if (success = False) then
  begin
    Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
    Exit;
  end;

// Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
sbRefUri := CkStringBuilder_Create();
bd := CkBinData_Create();
numRefs := CkXmlDSig_getNumReferences(verifier);
i := 0;
while i < numRefs do
  begin
    if (CkXmlDSig_IsReferenceExternal(verifier,i) = True) then
      begin
        CkStringBuilder_Clear(sbRefUri);
        CkStringBuilder_Append(sbRefUri,CkXmlDSig__referenceUri(verifier,i));
        if (CkStringBuilder_StartsWith(sbRefUri,'https://',False) = True) then
          begin
            Memo1.Lines.Add('External URL Reference: ' + CkStringBuilder__getAsString(sbRefUri));

            // Download the data at the URL and provide to the verifier.
            success := CkHttp_DownloadBd(http,CkStringBuilder__getAsString(sbRefUri),bd);
            if (success = False) then
              begin
                Memo1.Lines.Add(CkHttp__lastErrorText(http));
                Exit;
              end;
            success := CkXmlDSig_SetRefDataBd(verifier,i,bd);
            if (success = False) then
              begin
                Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
                Exit;
              end;
          end;
      end;
    i := i + 1;
  end;

// Now that we have the external data, verify the signature..
bVerified := CkXmlDSig_VerifySignature(verifier,True);
if (bVerified = False) then
  begin
    Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
  end;
Memo1.Lines.Add('Signature verified = ' + IntToStr(Ord(bVerified)));

CkXmlDSig_Dispose(verifier);
CkHttp_Dispose(http);
CkStringBuilder_Dispose(sbSignedXml);
CkStringBuilder_Dispose(sbRefUri);
CkBinData_Dispose(bd);

end;