CODEWITHSUNDEEP
securityoauth
Michael Stum
Michael Stum

Reputation: 180944

What is the idea behind hashing the QueryString in OAuth?

In OAuth 1.0a and 2.0 using MAC Authorization, I need to generate a hash of all the QueryString Parameters, which requires normalization (alphabetical ordering) of them.

I'm trying to understand what this offers from a security perspective over just generating a hash of Secret Key + Nonce + Timestamp?

My guess is that the additional entropy makes it harder to brute force the secret key, but I'm not really sure if that is the case.

Does anyone know what QueryString hashing offers in terms of security on top of simpler hashing?

Upvotes: 4

Views: 82

Answers (1)

Michael Stum
Michael Stum

Reputation: 180944

I asked @eranhammer on Twitter and the idea is to protect the URL from tampering.

Upvotes: 1

Related Questions