(Node.js) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOS

var os = require('os');
if (os.platform() == 'win32') {  
  var chilkat = require('@chilkat/ck-node23-win64'); 
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node23-linux-arm');
    } else if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node23-linux-arm64');
    } else {
        var chilkat = require('@chilkat/ck-node23-linux-x64');
    }
} else if (os.platform() == 'darwin') {
  var chilkat = require('@chilkat/ck-node23-mac-universal');
}

function chilkatExample() {

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // The signed XML we wish to verify contains external references such as this:

    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
    //     </ds:Reference>
    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
    //     </ds:Reference>

    var verifier = new chilkat.XmlDSig();
    var http = new chilkat.Http();

    // First load the signed XML
    var sbSignedXml = new chilkat.StringBuilder();
    var success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8");
    if (success == false) {
        console.log("Failed to load signed XML.");
        return;
    }

    success = verifier.LoadSignatureSb(sbSignedXml);
    if (success == false) {
        console.log(verifier.LastErrorText);
        return;
    }

    // Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
    var sbRefUri = new chilkat.StringBuilder();
    var bd = new chilkat.BinData();
    var numRefs = verifier.NumReferences;
    var i = 0;
    while (i < numRefs) {
        if (verifier.IsReferenceExternal(i) == true) {
            sbRefUri.Clear();
            sbRefUri.Append(verifier.ReferenceUri(i));
            if (sbRefUri.StartsWith("https://",false) == true) {
                console.log("External URL Reference: " + sbRefUri.GetAsString());

                // Download the data at the URL and provide to the verifier.
                success = http.DownloadBd(sbRefUri.GetAsString(),bd);
                if (success == false) {
                    console.log(http.LastErrorText);
                    return;
                }

                success = verifier.SetRefDataBd(i,bd);
                if (success == false) {
                    console.log(verifier.LastErrorText);
                    return;
                }

            }

        }

        i = i+1;
    }

    // Now that we have the external data, verify the signature..
    var bVerified = verifier.VerifySignature(true);
    if (bVerified == false) {
        console.log(verifier.LastErrorText);
    }

    console.log("Signature verified = " + bVerified);

}

chilkatExample();