SQL Server

Verify JWT Using HS256, HS384, or HS512

See more JSON Web Token (JWT) Examples

Demonstrates how to verify a JWT that was signed using HS256, HS384, or HS512. (HS256 is JWT's acronym for HMAC-SHA256.)

This example verifies the signature. It also does the following:

• Checks to see if the time constraints ("nbf" and "exp") are valid.
• Recovers the original JOSE header.
• Recovers the original claims JSON.

SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    -- Demonstrates how to verify an HMAC JWT using a shared secret (password).

    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @jwt int
    EXEC @hr = sp_OACreate 'Chilkat.Jwt', @jwt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @token nvarchar(4000)
    SELECT @token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vZXhhbXBsZS5vcmciLCJzdWIiOiJKb2huIiwiYXVkIjoiaHR0cDovL2V4YW1wbGUuY29tIiwiaWF0IjoxNDYzNDMxODEyLCJuYmYiOjE0NjM0MzE4MTIsImV4cCI6MTQ2MzQzNTQxMn0.SHnMJ11qJH5pbp22YchT_9fL2HIx0koHiUHLG67_foU'

    -- First verify the signature.
    -- The password used to create this JWT was "secret".
    DECLARE @sigVerified int
    EXEC sp_OAMethod @jwt, 'VerifyJwt', @sigVerified OUT, @token, 'secret'

    PRINT 'with correct password: ' + @sigVerified

    -- Now try with a different password:
    EXEC sp_OAMethod @jwt, 'VerifyJwt', @sigVerified OUT, @token, 'secret2'

    PRINT 'with incorrect password ' + @sigVerified

    -- Let's see if the time constraints, if any, are valid.
    -- The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
    -- If the current system time is before the "nbf" time, or after the "exp" time,
    -- then IsTimeValid will return false/0.
    -- Also, we'll allow a leeway of 60 seconds to account for any clock skew.
    -- Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
    DECLARE @leeway int
    SELECT @leeway = 60
    DECLARE @bTimeValid int
    EXEC sp_OAMethod @jwt, 'IsTimeValid', @bTimeValid OUT, @token, @leeway

    PRINT 'time constraints valid: ' + @bTimeValid

    -- Now let's recover the original claims JSON (the payload).
    DECLARE @payload nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetPayload', @payload OUT, @token
    -- The payload will likely be in compact form:

    PRINT @payload

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    DECLARE @json int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT

    EXEC sp_OAMethod @json, 'Load', @success OUT, @payload
    EXEC sp_OASetProperty @json, 'EmitCompact', 0
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    -- We can recover the original JOSE header in the same way:
    DECLARE @joseHeader nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetHeader', @joseHeader OUT, @token
    -- The payload will likely be in compact form:

    PRINT @joseHeader

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    EXEC sp_OAMethod @json, 'Load', @success OUT, @joseHeader
    EXEC sp_OASetProperty @json, 'EmitCompact', 0
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    EXEC @hr = sp_OADestroy @jwt
    EXEC @hr = sp_OADestroy @json


END
GO