CODEWITHSUNDEEP
phpoauth
user3180943
user3180943

Reputation: 331

OAuth: invalid oauth_signature

I am stuck generating the OAuth signature programmatically. I am on FreeBSD with PHP71 and can not use the PECL extension, because it doesn't work with PHP > 5.6 yet.

I read the RFC and many many SO threads as well as blogs that all have the same problem I have. But I can't figure out where I failed.

I am trying to obtain a request token from the XING.com Api.

My Code:

$strConsumerKey    = '12345';
$strConsumerSecret = '1234567890';

$arrQueryParams = [

  'oauth_callback'         => 'http://xing.dev/endpoint?hauth.done=XING',
  'oauth_consumer_key'     => $strConsumerKey,
  'oauth_nonce'            => md5(microtime() . mt_rand()),
  'oauth_signature_method' => 'HMAC-SHA1',
  'oauth_timestamp'        => time(),
  'oauth_version'          => '1.0'

];

uksort($arrQueryParams, 'strcmp');

$strNormalizedParams = [];

foreach($arrQueryParams AS $k => $v)
  $strNormalizedParams[] = $k . '=' . $v;

$strRequestTokenUrl = 'https://api.xing.com/v1/request_token';
$strBaseString      = 'GET&' . rawurlencode($strRequestTokenUrl) . '&' . rawurlencode(implode('&', $strNormalizedParams));

$strKey = rawurlencode($strConsumerSecret) . '&';# . rawurlencode($strConsumerKey);

$strOAuthSignature  = base64_encode(hash_hmac('sha1', $strBaseString, $strKey, true));

$arrQueryParams['oauth_signature'] = $strOAuthSignature;
uksort($arrQueryParams, 'strcmp');

$params = [];

foreach($arrQueryParams AS $k => $v)
  $params[] = $k . '=' . rawurlencode($v);

$strFinalRequest = $strRequestTokenUrl . '?' . implode('&', $params);

$ch = curl_init($strFinalRequest);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$mixResponse = curl_exec($ch);

var_dump($mixResponse);

curl_close($ch);

exit;

$strBaseString example:

GET&https%3A%2F%2Fapi.xing.com%2Fv1%2Frequest_token&oauth_callback%3Dhttp%3A%2F%2Fxing.dev%2Fendpoint%3Fhauth.done%3DXING%26oauth_consumer_key%3D12345%26oauth_nonce%3Daadab05f87028514358e5995dc6728fd%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1503318691%26oauth_version%3D1.0

Final Request example:

https://api.xing.com/v1/request_token?oauth_callback=http%3A%2F%2Fxing.dev%2Fendpoint%3Fhauth.done%3DXING&oauth_consumer_key=12345&oauth_nonce=71f83f72b929a87e5fdd6bf1a7fb2511&oauth_signature=56qc3%252FCrMptnUoy6TgsJtsZclfY%253D&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1503318773&oauth_version=1.0

The response is always:

{"message":"Invalid OAuth signature","error_name":"INVALID_OAUTH_SIGNATURE"}

The real funny think is though, that the https://github.com/xing/xing-api-samples/tree/master/php XING client works on my machine. I debugged the code and looked how they are generating the signature, dumped out the generated base string, the final string, params, etc. and everything looks like what I do. (Except for the values of oauth_timestamp and oauth_nonce of course)

Also I can reproduce the results on the oauth example: https://oauth.net/core/1.0/#sig_base_example

This makes it even more strange.

Has anyone an idea what I am doing wrong? Thank you and best regards

Upvotes: 1

Views: 1170

Answers (1)

user3180943
user3180943

Reputation: 331

Found the mistake:

$strBaseString = 'GET&' . rawurlencode($strRequestTokenUrl) . '&' . rawurlencode(implode('&', $strNormalizedParams));

should be

$strBaseString = 'GET&' . rawurlencode($strRequestTokenUrl) . '&' . rawurlencode(http_build_query($arrQueryParams));

Upvotes: 1

Related Questions