Home / Questions / 273751
Accepted
Soy César Mora
Asked: 2020-06-22 05:59:33 +0800 CST 2020-06-22 05:59:33 +0800 CST

How to sign a request correctly with OAUTH 1.0

  • 772

I need to sign a request, I am using Andy Smith 's Oauth library and I need to generate the authorization for the header.

The problem is that I always get Message signature not valid in my TC, so I guess I'm generating the input parameters wrong to sign the request.

  $method = 'http';
  $url = 'http://cvirtual.cl/mod/lti/service.php';
  $request = new OAuthRequest($method, $url);
  $token = new OAuthToken('asd123', '8cUIaGVLhmg4pe7gqoOu3ldxJTOXyNmu');
  $consumer = new OAuthConsumer('asd123', '8cUIaGVLhmg4pe7gqoOu3ldxJTOXyNmu', 'about:blank');
  $signature = new OAuthSignatureMethod_HMAC_SHA1();
  $request = $request->from_consumer_and_token($consumer, $token, $method, $url);
  $request->sign_request($signature, $consumer, $token);
  echo("<textarea rows='5' cols='100'>{$request->to_header()}</textarea>");

If someone can answer the following questions to better understand the protocol, it would be of great help.

  1. Is the method with or without ://? (Ex: http:// or http)
  2. Does the url include http://?
  3. Is the url of the person issuing the request or the url to whom the request is made?
  4. What about friendly routes, should .php be included in the link to sign the petition?

The library gives me the following header:

Authorization: OAuth oauth_version="1.0",oauth_nonce="7243daf569edbad7309bc19fd724244e",oauth_timestamp="1561125182",oauth_consumer_key="asd123",oauth_token="asd123",oauth_signature_method="HMAC-SHA1",oauth_signature="yn0cSIQg3Aj6FIWalE%2FIrktaFbA%3D"

I'm trying to send a request with POSTMAN , should it start with OAuth or directly in the key value parameters like oauth_version?Image of POSTMAN

It is worth mentioning that I am working locally and without HTTPS

php

1 Answers

  1. Best Answer

    Answering your questions...

    1.- Is the method with or without ://? (Ex: http:// or http)

    The method used is the HTTP verb (GET, POST, etc) not the request type (http, https)

    2.- Does the url include http://?

    Yes, the url requires http or https otherwise.

    Is the url of the person issuing the request or the url to whom the request is made?

    The url is of the domain to which you will make the request

    What about friendly routes, should .php be included in the link to sign the petition?

    The path must be identical, if it is friendly it should not include .php

    • 1