(Unicode C) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat C/C++ Library Downloads
MS Visual C/C++ C++ Builder Linux C/C++ Alpine Linux C/C++	MacOS C/C++ iOS C/C++ Android C/C++ MinGW C/C++

#include <C_CkXmlDSigW.h>
#include <C_CkHttpW.h>
#include <C_CkStringBuilderW.h>
#include <C_CkBinDataW.h>

void ChilkatSample(void)
    {
    HCkXmlDSigW verifier;
    HCkHttpW http;
    HCkStringBuilderW sbSignedXml;
    BOOL success;
    HCkStringBuilderW sbRefUri;
    HCkBinDataW bd;
    int numRefs;
    int i;
    BOOL bVerified;

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // The signed XML we wish to verify contains external references such as this:

    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
    //     </ds:Reference>
    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
    //     </ds:Reference>

    verifier = CkXmlDSigW_Create();
    http = CkHttpW_Create();

    // First load the signed XML
    sbSignedXml = CkStringBuilderW_Create();
    success = CkStringBuilderW_LoadFile(sbSignedXml,L"qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml",L"utf-8");
    if (success == FALSE) {
        wprintf(L"Failed to load signed XML.\n");
        CkXmlDSigW_Dispose(verifier);
        CkHttpW_Dispose(http);
        CkStringBuilderW_Dispose(sbSignedXml);
        return;
    }

    success = CkXmlDSigW_LoadSignatureSb(verifier,sbSignedXml);
    if (success == FALSE) {
        wprintf(L"%s\n",CkXmlDSigW_lastErrorText(verifier));
        CkXmlDSigW_Dispose(verifier);
        CkHttpW_Dispose(http);
        CkStringBuilderW_Dispose(sbSignedXml);
        return;
    }

    // Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
    sbRefUri = CkStringBuilderW_Create();
    bd = CkBinDataW_Create();
    numRefs = CkXmlDSigW_getNumReferences(verifier);
    i = 0;
    while (i < numRefs) {
        if (CkXmlDSigW_IsReferenceExternal(verifier,i) == TRUE) {
            CkStringBuilderW_Clear(sbRefUri);
            CkStringBuilderW_Append(sbRefUri,CkXmlDSigW_referenceUri(verifier,i));
            if (CkStringBuilderW_StartsWith(sbRefUri,L"https://",FALSE) == TRUE) {
                wprintf(L"External URL Reference: %s\n",CkStringBuilderW_getAsString(sbRefUri));

                // Download the data at the URL and provide to the verifier.
                success = CkHttpW_DownloadBd(http,CkStringBuilderW_getAsString(sbRefUri),bd);
                if (success == FALSE) {
                    wprintf(L"%s\n",CkHttpW_lastErrorText(http));
                    CkXmlDSigW_Dispose(verifier);
                    CkHttpW_Dispose(http);
                    CkStringBuilderW_Dispose(sbSignedXml);
                    CkStringBuilderW_Dispose(sbRefUri);
                    CkBinDataW_Dispose(bd);
                    return;
                }

                success = CkXmlDSigW_SetRefDataBd(verifier,i,bd);
                if (success == FALSE) {
                    wprintf(L"%s\n",CkXmlDSigW_lastErrorText(verifier));
                    CkXmlDSigW_Dispose(verifier);
                    CkHttpW_Dispose(http);
                    CkStringBuilderW_Dispose(sbSignedXml);
                    CkStringBuilderW_Dispose(sbRefUri);
                    CkBinDataW_Dispose(bd);
                    return;
                }

            }

        }

        i = i + 1;
    }

    // Now that we have the external data, verify the signature..
    bVerified = CkXmlDSigW_VerifySignature(verifier,TRUE);
    if (bVerified == FALSE) {
        wprintf(L"%s\n",CkXmlDSigW_lastErrorText(verifier));
    }

    wprintf(L"Signature verified = %d\n",bVerified);


    CkXmlDSigW_Dispose(verifier);
    CkHttpW_Dispose(http);
    CkStringBuilderW_Dispose(sbSignedXml);
    CkStringBuilderW_Dispose(sbRefUri);
    CkBinDataW_Dispose(bd);

    }