Verify Method
Verifies the signature of the JWS token.
procedure Verify();
Remarks
This method verifies the signature of the JWS token.
Before calling the Verify method set InputMessage or InputFile to a valid compact serialized JWS string. For instance:
eyJhbGciOiJIUzI1NiJ9.dGVzdA.o_JihJlCwvBO1AgY_Ao3_VBivdFmj3ufv3ZWAqYF4Ow
Key or Certificate should be set to the HMAC key or public certificate respectively. If the correct Key or Certificate is not known ahead of time the KeyId parameter of the SignerInfo event may be used to identify the correct key.
If this method returns without error verification was successful. If verification fails then this method raises an exception. After calling this method the payload will be present in the OutputMessage or file specified by OutputFile and the Header* properties will contain the headers. Headers of the parsed message are also available through the HeaderParam event.
The following properties are applicable when calling this method:
- Key (conditional - required for HMAC)
- Certificate (conditional - required for ECDSA and RSA)
- Algorithm (only if StrictValidation is True)
- Overwrite
- StrictValidation
Input and Output Properties
The component will determine the source and destination of the input and output based on which properties are set.
The order in which the input properties are checked is as follows:
When a valid source is found the search stops. The order in which the output properties are checked is as follows:
- SetOutputStream
- OutputFile
- OutputMessage: The output data is written to this property if no other destination is specified.
When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.
Notes for HMAC Algorithms (HS256, HS384, HS512)
When verifying a message originally signed with a HMAC algorithm Key must be set to the same key used during signing. The key must be known by both parties in order for signing and verification to take place.
byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 };
Jws jws = new Jws();
jws.KeyB = key;
jws.InputMessage = signedData;
jws.Verify();
string verifiedPayload = jws.OutputMessage;
Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)
The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The public key is typically in PEM format.
Jws jws = new Jws();
jws.Certificate = new Certificate("..\\jwt.cer");
jws.InputMessage = signedData;
jws.Verify();
string verifiedPayload = jws.OutputMessage;
Notes for ECDSA Algorithms (ES256, ES384, ES512)
ECDSA algorithms require a valid ECC public key to verify the message. If the key was originally created with the ECC component the PEM encoded PublicKey may be used directly with the Certificate property. An example PEM encoded public certificate created by the ECC component:
-----BEGIN PUBLIC KEY-----
MIIBMjCB7AYHKoZIzj0CATCB4AIBATAsBgcqhkjOPQEBAiEA/////wAAAAEAAAAAAAAAAAAA
AAD///////////////8wRAQg/////wAAAAEAAAAAAAAAAAAAAAD///////////////wEIFrG
NdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n0mBLBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt
6zOg9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA
//////////+85vqtpxeehPO5ysL8YyVRAgEBA0EEIC5rbLp11Mnz6cBXLLriaDIov3rm8RAY
x/OR0bOKiff0cQy+sLVaxjseqFk/+Xvl4ORSv5Z6HdHv5GyEpA0UoA==
-----END PUBLIC KEY-----
Jws jws = new Jws();
jws.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*");
jws.InputMessage = signedData;
jws.Verify();
string verifiedPayload = jws.OutputMessage;
To use an ECC public key created by other means the ECC component may be used to import the key parameters. Populate the Rx and Ry of the ECC component first to obtain the PEM formatted public key. For instance:
//Import an existing ECC public key
Ecc ecc = new Ecc();
byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 };
byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 };
ecc.Key.RxB = x_bytes;
ecc.Key.RyB = y_bytes;
string pubKey = ecc.Key.PublicKey;
Jws jws = new Jws();
jws.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*");
jws.InputMessage = signedData;
jws.Verify();
string verifiedPayload = jws.OutputMessage;
Notes for Unsecured (none)
To parse a JWS token without any security call the Sign method without setting Key or Certificate.
Jws jws = new Jws();
jws.InputMessage = signedData;
jws.Verify();
string unsecuredPayload = jws.OutputMessage;