(Xojo Plugin) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat Xojo Plugin Download Xojo Plugin for Windows, Linux, Mac OS X, and ARM, ARM64

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed XML we wish to verify contains external references such as this:

//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//     </ds:Reference>
//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//     </ds:Reference>

Dim verifier As New Chilkat.XmlDSig
Dim http As New Chilkat.Http

// First load the signed XML
Dim sbSignedXml As New Chilkat.StringBuilder
Dim success As Boolean
success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8")
If (success = False) Then
    System.DebugLog("Failed to load signed XML.")
    Return
End If

success = verifier.LoadSignatureSb(sbSignedXml)
If (success = False) Then
    System.DebugLog(verifier.LastErrorText)
    Return
End If

// Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
Dim sbRefUri As New Chilkat.StringBuilder
Dim bd As New Chilkat.BinData
Dim numRefs As Int32
numRefs = verifier.NumReferences
Dim i As Int32
i = 0
While i < numRefs
    If (verifier.IsReferenceExternal(i) = True) Then
        sbRefUri.Clear 
        success = sbRefUri.Append(verifier.ReferenceUri(i))
        If (sbRefUri.StartsWith("https://",False) = True) Then
            System.DebugLog("External URL Reference: " + sbRefUri.GetAsString())

            // Download the data at the URL and provide to the verifier.
            success = http.DownloadBd(sbRefUri.GetAsString(),bd)
            If (success = False) Then
                System.DebugLog(http.LastErrorText)
                Return
            End If

            success = verifier.SetRefDataBd(i,bd)
            If (success = False) Then
                System.DebugLog(verifier.LastErrorText)
                Return
            End If

        End If

    End If

    i = i + 1
Wend

// Now that we have the external data, verify the signature..
Dim bVerified As Boolean
bVerified = verifier.VerifySignature(True)
If (bVerified = False) Then
    System.DebugLog(verifier.LastErrorText)
End If

System.DebugLog("Signature verified = " + Str(bVerified))