(PHP Extension) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat PHP Downloads PHP Extension for Windows, Linux, MacOS, Alpine Linux, Solaris

<?php

// The version number (9_5_0) should match version of the Chilkat extension used, omitting the micro-version number.
// For example, if using Chilkat v9.5.0.48, then include as shown here:
include("chilkat_9_5_0.php");

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed XML we wish to verify contains external references such as this:

//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//     </ds:Reference>
//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//     </ds:Reference>

$verifier = new CkXmlDSig();
$http = new CkHttp();

// First load the signed XML
$sbSignedXml = new CkStringBuilder();
$success = $sbSignedXml->LoadFile('qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml','utf-8');
if ($success == false) {
    print 'Failed to load signed XML.' . "\n";
    exit;
}

$success = $verifier->LoadSignatureSb($sbSignedXml);
if ($success == false) {
    print $verifier->lastErrorText() . "\n";
    exit;
}

// Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
$sbRefUri = new CkStringBuilder();
$bd = new CkBinData();
$numRefs = $verifier->get_NumReferences();
$i = 0;
while ($i < $numRefs) {
    if ($verifier->IsReferenceExternal($i) == true) {
        $sbRefUri->Clear();
        $sbRefUri->Append($verifier->referenceUri($i));
        if ($sbRefUri->StartsWith('https://',false) == true) {
            print 'External URL Reference: ' . $sbRefUri->getAsString() . "\n";

            // Download the data at the URL and provide to the verifier.
            $success = $http->DownloadBd($sbRefUri->getAsString(),$bd);
            if ($success == false) {
                print $http->lastErrorText() . "\n";
                exit;
            }

            $success = $verifier->SetRefDataBd($i,$bd);
            if ($success == false) {
                print $verifier->lastErrorText() . "\n";
                exit;
            }

        }

    }

    $i = $i + 1;
}

// Now that we have the external data, verify the signature..
$bVerified = $verifier->VerifySignature(true);
if ($bVerified == false) {
    print $verifier->lastErrorText() . "\n";
}

print 'Signature verified = ' . $bVerified . "\n";

?>