CODEWITHSUNDEEP
ruby-on-railsrubyapioauthyahoo-api
anders32
anders32

Reputation: 295

Yahoo Oauth in Ruby API Request - Signature Invalid

I have already successfully gotten the access token and access secret. Now I'm trying to make an API request with the OAuth information.

I'm following alongside the yahoo docs (not very helpful): https://developer.yahoo.com/oauth/guide/oauth-make-request.html https://developer.yahoo.com/oauth/guide/oauth-signing.html

Also, I'm trying to follow this example closely: https://gist.github.com/cheenu/1469815

Here is the code: (I split up the long url for convenience)

require 'cgi'
require 'base64'
require 'openssl'

url = "http://fantasysports.yahooapis.com/fantasy/v2/game/nfl"
parameters = "format=json
  &realm=yahooapis.com
  &oauth_consumer_key=#{Rails.application.secrets.yhoo_consumer_key}
  &oauth_nonce=#{SecureRandom.hex}
  &oauth_signature_method=HMAC-SHA1
  &oauth_timestamp=#{Time.now.to_i}
  &oauth_token=#{ApiVar.final_oauth_token} #the access token
  &oauth_version=1.0"

base_string = 'GET&' + CGI.escape(url) + '&' + CGI.escape(parameters)

oauth_signature = CGI.escape(Base64.encode64("#{OpenSSL::HMAC.digest('sha1', ApiVar.final_oauth_secret + "&", base_string)}").chomp)

#ApiVar.final_oauth_secret is the access token secret - is that what I should be putting there?

testable_url = url + '?' + parameters + '&oauth_signature=' + oauth_signature
p testable_url
response = HTTParty.get(testable_url)

My response gives me "signature_invalid."

What am I doing wrong?

Thank you!

Upvotes: 1

Views: 438

Answers (2)

anders32
anders32

Reputation: 295

    url = "http://fantasysports.yahooapis.com/fantasy/v2/league/{league-key}/players"
    parameters = "format=json&oauth_consumer_key=#{Rails.application.secrets.yhoo_consumer_key}&oauth_nonce=#{SecureRandom.hex}&oauth_signature_method=HMAC-SHA1&oauth_timestamp=#{Time.now.to_i}&oauth_token=#{ApiVar.final_oauth_token}&oauth_version=1.0&realm=yahooapis.com"
    base_string = 'GET&' + CGI.escape(url) + '&' + CGI.escape(parameters)
    secret = "#{Rails.application.secrets.yhoo_consumer_secret}&#{ApiVar.final_oauth_secret}"
    oauth_signature = CGI.escape(Base64.encode64("#{OpenSSL::HMAC.digest('sha1', secret, base_string)}").chomp)
    testable_url = url + '?' + parameters + '&oauth_signature=' + oauth_signature
    p testable_url
    response = HTTParty.get(testable_url)

#{Rails.application.secrets.yhoo_consumer_secret}&#{ApiVar.final_oauth_secret}" - correct secret key

The parameters have to be ordered alphabetically! Also, the secret key is the yahoo consumer secret plus the final oauth secret!

Upvotes: 3

Ronen Botzer
Ronen Botzer

Reputation: 7117

The first thing that I can see as problematic is that the paremeters have a lot of whitespace that you do not want. Try the following instead:

parameters = "format=json" +
  "&realm=yahooapis.com" +
  "&oauth_consumer_key=#{Rails.application.secrets.yhoo_consumer_key}" +
  "&oauth_nonce=#{SecureRandom.hex}" +
  "&oauth_signature_method=HMAC-SHA1" +
  "&oauth_timestamp=#{Time.now.to_i}" +
  "&oauth_token=#{ApiVar.final_oauth_token}" +
  "&oauth_version=1.0"

The other issue is that I do not believe your secret key needs the ampersand symbol added to it when you're creating the signature:

oauth_signature = CGI.escape(Base64.encode64("#{OpenSSL::HMAC.digest('sha1', ApiVar.final_oauth_secret, base_string)}").chomp)

Upvotes: 0

Related Questions