(PHP ActiveX) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows Note: The php_com_dotnet.dll may need to be enabled inside of php.ini.

<?php

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed XML we wish to verify contains external references such as this:

//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//     </ds:Reference>
//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//     </ds:Reference>

// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.XmlDSig')
$verifier = new COM("Chilkat.XmlDSig");
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.Http')
$http = new COM("Chilkat.Http");

// First load the signed XML
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.StringBuilder')
$sbSignedXml = new COM("Chilkat.StringBuilder");
$success = $sbSignedXml->LoadFile('qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml','utf-8');
if ($success == 0) {
    print 'Failed to load signed XML.' . "\n";
    exit;
}

$success = $verifier->LoadSignatureSb($sbSignedXml);
if ($success == 0) {
    print $verifier->LastErrorText . "\n";
    exit;
}

// Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.StringBuilder')
$sbRefUri = new COM("Chilkat.StringBuilder");
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.BinData')
$bd = new COM("Chilkat.BinData");
$numRefs = $verifier->NumReferences;
$i = 0;
while ($i < $numRefs) {
    if ($verifier->IsReferenceExternal($i) == 1) {
        $sbRefUri->Clear();
        $sbRefUri->Append($verifier->referenceUri($i));
        if ($sbRefUri->StartsWith('https://',0) == 1) {
            print 'External URL Reference: ' . $sbRefUri->getAsString() . "\n";

            // Download the data at the URL and provide to the verifier.
            $success = $http->DownloadBd($sbRefUri->getAsString(),$bd);
            if ($success == 0) {
                print $http->LastErrorText . "\n";
                exit;
            }

            $success = $verifier->SetRefDataBd($i,$bd);
            if ($success == 0) {
                print $verifier->LastErrorText . "\n";
                exit;
            }

        }

    }

    $i = $i + 1;
}

// Now that we have the external data, verify the signature..
$bVerified = $verifier->VerifySignature(1);
if ($bVerified == 0) {
    print $verifier->LastErrorText . "\n";
}

print 'Signature verified = ' . $bVerified . "\n";

?>