invalid signature

[joeljb]

Buenos días estoy tratando de firmar un xml cuando coloco

sig.addReference(xpath, ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"],"http://www.w3.org/2001/04/xmlenc#sha256","","","",false)
lo valida pero cuando cuando coloco

sig.addReference(xpath, ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"],"http://www.w3.org/2001/04/xmlenc#sha256","","","",true)

me devuelve el siguiente error
[ 'invalid signature: for uri calculated digest is oUP1akifFqmjvHDVtpeQC8h0l9LqL1YLf+PPOxzj8Rs= but the xml to validate supplies digest yY+OHWVStrsKgaqmoVNfy3hHoZf1lXomRKflwW4bhc0=' ]

lo que quiero es quitar Id="_0" y
URI="#_0" dejarlo URI=""

[SmartLayer]

Looking at the code,

• If you give isEmptyUri a false value, as in your first example, then the ID of the node at xpath will be used, which works in your first example.

• If you give isEmptyUri a true value, then the first parameter will be ignored, which caused the digest error in your second example.

https://github.com/yaronn/xml-crypto/blob/40bd9e8f8787c9c996572fe5937572506b9e43d1/lib/signed-xml.js#L790-L797

Personally I think APIs can be designed to avoid misuses. I recommend having 2 APIs:

addReference = function(
xpath, transforms, digestAlgorithm, uri, digestValue, inclusiveNamespacesPrefixList)

and

addReferenceEmptyURI = function(transforms, digestAlgorithm, uri, digestValue, inclusiveNamespacesPrefixList)

XMLDSig is complicated enough any effort from the library to make developers less able to produce non-working calls is of great help!

¿Por cierto, puedes modificar el título? La mitad de las personas viven aquí con un problema para verificar una firma (las otras una problema para firmar), por lo tanto, "invalid signature" no transmte información.

[mightypenguin]

Not sure if this is related but I get the "invalid signature" error from v1.4.1 onwards (using passport-saml v1.3.3)

[Rodrigobanselmo]

I hade the same problem and to sove this you have to add xpath as /*

sig.addReference(
    // reference to the root node
    "/*",
    [
      'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
      'http://www.w3.org/2001/10/xml-exc-c14n#'
    ],
    'http://www.w3.org/2000/09/xmldsig#sha1',
    '',
    '',
    '',
    // let the URI attribute with an empty value,
    // this is the signal that the signature is affecting the whole xml document
    true
);

on #122 explains that

[cjbarth]

It seems that this issue has been resolved. If this is not the case, please reply to reopen.