(CkPython) Validate a JWS Using ECDSA P-256 SHA-256

Validates a JSON Web Signature (JWS) that uses ECDSA P-256 SHA-256

Note: This example requires Chilkat v9.5.0.66 or greater.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: This example requires Chilkat v9.5.0.66 or greater.

# This example takes a JSON signature in compact serialization format,
# and uses an ECDSA public key to validate and recover the protected header and payload.

# We only need a public key for signature validation.  This is the ECDSA public key
# that is used:

#      {"kty":"EC", 
#       "crv":"P-256", 
#       "x":"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU", 
#       "y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0" 
#      } 

sbPubKey = chilkat.CkStringBuilder()
sbPubKey.Append("{\"kty\":\"EC\",")
sbPubKey.Append("\"crv\":\"P-256\",")
sbPubKey.Append("\"x\":\"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU\",")
sbPubKey.Append("\"y\":\"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0\"")
sbPubKey.Append("}")

pubKey = chilkat.CkPublicKey()
success = pubKey.LoadFromString(sbPubKey.getAsString())
if (success != True):
    print(pubKey.lastErrorText())
    sys.exit()

jws = chilkat.CkJws()

# Set the ECC public key:
signatureIndex = 0
jws.SetPublicKey(signatureIndex,pubKey)

# Load the JWS.
sbJws = chilkat.CkStringBuilder()
sbJws.Append("eyJhbGciOiJFUzI1NiJ9")
sbJws.Append(".")
sbJws.Append("eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt")
sbJws.Append("cGxlLmNvbS9pc19yb290Ijp0cnVlfQ")
sbJws.Append(".")
sbJws.Append("DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8ISlSA")
sbJws.Append("pmWQxfKTUJqPP3-Kg6NU1Q")

success = jws.LoadJwsSb(sbJws)
if (success != True):
    print(jws.lastErrorText())
    sys.exit()

# Validate the 1st (and only) signature at index 0..
v = jws.Validate(signatureIndex)
if (v < 0):
    # Perhaps Chilkat was not unlocked or the trial expired..
    print("Method call failed for some other reason.")
    print(jws.lastErrorText())
    sys.exit()

if (v == 0):
    print("Invalid signature.  The ECC key was incorrect, the JWS was invalid, or both.")
    sys.exit()

# If we get here, the signature was validated..
print("Signature validated.")
print("--")

# Recover the original content:
print("Recovered content:")
print(jws.getPayload("utf-8"))
print("--")

# Examine the protected header:
# joseHeader is a CkJsonObject
joseHeader = jws.GetProtectedHeader(signatureIndex)
if (jws.get_LastMethodSuccess() != True):
    print("No protected header found at the given index.")
    sys.exit()

joseHeader.put_EmitCompact(False)

print("Protected (JOSE) header:")
print(joseHeader.emit())

# Output:

# 	Signature validated.
# 	--
# 	Recovered content:
# 	{"iss":"joe",
# 	 "exp":1300819380,
# 	 "http://example.com/is_root":true}
# 	--
# 	Protected (JOSE) header:
# 	{ 
# 	  "alg": "ES256"
# 	}