[GH-ISSUE #115 ] Error in signature calculation #68

Author

Owner

@perfectflowltd commented on GitHub (Oct 9, 2015):

I'm seeing this issue too. olivier38070 fix didn't work for me

@perfectflowltd commented on GitHub (Oct 9, 2015): I'm seeing this issue too. olivier38070 fix didn't work for me

kerem commented

Author

Owner

@phimage commented on GitHub (Nov 11, 2015):

@App8ite if you try olivier fix, could you commit into your fork? (into a branch)
maybe also #80

@phimage commented on GitHub (Nov 11, 2015): @App8ite if you try olivier fix, could you commit into your fork? (into a branch) maybe also #80

kerem commented

Author

Owner

@olivier38070 commented on GitHub (Nov 11, 2015):

sorry to have been lazy. I should have committed my stuff, and forgot it
(too overloaded in my job)

I will try to do it soon, I have to get my source back.

2015-11-11 10:01 GMT+01:00 Phi Mage notifications@github.com:

@App8ite https://github.com/App8ite if you try olivier fix, could you
commit into your fork? (into a branch)

—
Reply to this email directly or view it on GitHub
https://github.com/dongri/OAuthSwift/issues/115#issuecomment-155709144.

@olivier38070 commented on GitHub (Nov 11, 2015): sorry to have been lazy. I should have committed my stuff, and forgot it (too overloaded in my job) I will try to do it soon, I have to get my source back. 2015-11-11 10:01 GMT+01:00 Phi Mage notifications@github.com: > @App8ite https://github.com/App8ite if you try olivier fix, could you > commit into your fork? (into a branch) > > — > Reply to this email directly or view it on GitHub > https://github.com/dongri/OAuthSwift/issues/115#issuecomment-155709144.

kerem commented

Author

Owner

@pculligan commented on GitHub (Nov 13, 2015):

Is there a test case that can demonstrate what's wrong? I am curious if #141 fixed this. There have been some changes in this area and I'd like to know if it's still open. If you can describe the case, I'll test.

@pculligan commented on GitHub (Nov 13, 2015): Is there a test case that can demonstrate what's wrong? I am curious if #141 fixed this. There have been some changes in this area and I'd like to know if it's still open. If you can describe the case, I'll test.

kerem commented

Author

Owner

@phimage commented on GitHub (Nov 26, 2015):

added unit test about signature 4ec66e4fd1 (based on google unit test)

to fix potential issues or label this issue as bug, I need an oauth data set (URL,parameters,consumer key,consumer secret,token,token secret,timestamp,nonce)

@phimage commented on GitHub (Nov 26, 2015): added unit test about signature 4ec66e4fd1d3133e75a32880f655b0f17016d4a2 (based on google unit test) to fix potential issues or label this issue as bug, I need an oauth data set (URL,parameters,consumer key,consumer secret,token,token secret,timestamp,nonce)

kerem commented

Author

Owner

@ohcrfpv commented on GitHub (Dec 13, 2015):

When I done a POST to twitter api, it responded a message 'Could not authenticate you.'. The same issue?

@ohcrfpv commented on GitHub (Dec 13, 2015): When I done a POST to twitter api, it responded a message 'Could not authenticate you.'. The same issue?

kerem commented

Author

Owner

@phimage commented on GitHub (Dec 13, 2015):

@fewspider thank you to look for a potential identical issue, but for this issue I am waiting for a sample code with problem (api, version, parameters, etc...) from @olivier38070
And I keep open to maybe study the code...

Some signature problem has been fixed last month

You can open a new issue with the version used of OAuthSwift, the code, parameters, etc.. and I will test

@phimage commented on GitHub (Dec 13, 2015): @fewspider thank you to look for a potential identical issue, but for this issue I am waiting for a sample code with problem (api, version, parameters, etc...) from @olivier38070 And I keep open to maybe study the code... Some signature problem has been fixed last month You can open a new issue with the version used of OAuthSwift, the code, parameters, etc.. and I will test

kerem commented

Author

Owner

@ohcrfpv commented on GitHub (Dec 13, 2015):

@phimage ok,wait a minute

@ohcrfpv commented on GitHub (Dec 13, 2015): @phimage ok,wait a minute

kerem commented

Author

Owner

@ohcrfpv commented on GitHub (Dec 13, 2015):

@phimage done

@ohcrfpv commented on GitHub (Dec 13, 2015): @phimage done

kerem commented

Author

Owner

@olivier38070 commented on GitHub (Dec 14, 2015):

Hi,

sorry, I was too busy by my job.
now, I updated the code, and it seems that it has evolve a lot.

I Will have difficulties to commit anything, as my code also is a fork from
an old version, with some modification to work.

what do you suggest I do ?
I could try to get the latest version, remove all my code in my application
and check what if it is working...
(I remind that on my side, I could login on smugmug, but I couldn't
send/upload any images)

here is what gave me trouble :

the signature calculation gave me error, in smugmug, when trying to do
upload.
the code bellow (Part A) is replacing this :
public func signatureForMethod(method: OAuthSwiftHTTPRequest.Method,
url: NSURL, parameters: Dictionary<String, AnyObject>) -> String {
}
located in OauthSwiftCredential.swift

Also, I had trouble with the encoding of the request, when sending datas :

Part A :

// convert a Dictionary, in array of string, with escaped string
func getEscapedArrayParam(parameters: Dictionary<String, AnyObject>) ->
[String] {
// escape all oauth parameter
var encodedParam = String
for(k, v) in parameters {
let str = k + "=" + (v as! String)
let escapedStr =
str.stringByAddingPercentEncodingWithAllowedCharacters(.URLHostAllowedCharacterSet())
encodedParam.append(escapedStr!)
}
// sort the result
encodedParam.sortInPlace{ $0 < $1 }
return encodedParam
}

// do almost like stringByAddingPercentEncodingWithAllowedCharacters,

but take in account more character to be changed in %xyz
//!'();:@&=+$,/?%#[]
func escapeString(str: String) -> String {
let encoding: NSStringEncoding = NSUTF8StringEncoding
// !'();:@&=+$,/?%#[]
let charactersToBeEscaped = ":/?&=;+!@#$()',*" as CFStringRef
let charactersToLeaveUnescaped = "[]." as CFStringRef
let raw: NSString = str
let result =
CFURLCreateStringByAddingPercentEscapes(kCFAllocatorDefault, raw,
charactersToLeaveUnescaped, charactersToBeEscaped,
CFStringConvertNSStringEncodingToEncoding(encoding))
return result as String
}

public func encodeParameters(method: String, url: NSURL, parameters:

Dictionary<String, AnyObject>, credential: OAuthSwiftCredential) -> String {

    // algorithm used :

https://dev.twitter.com/oauth/overview/creating-signatures
// will add the oauth_signature parameter

    //define the oauth parameters
    var authorizationParameters = Dictionary<String, AnyObject>()
    authorizationParameters["oauth_version"] = OAuth.version
    authorizationParameters["oauth_consumer_key"] =

credential.consumer_key
authorizationParameters["oauth_timestamp"] =
String(Int64(NSDate().timeIntervalSince1970))
authorizationParameters["oauth_nonce"] = (NSUUID().UUIDString as
NSString).substringToIndex(8)
authorizationParameters["oauth_signature_method"] =
OAuth.signatureMethod
// add token is it exist
if (credential.oauth_token != ""){
authorizationParameters["oauth_token"] = credential.oauth_token
}
// add additionnal oauth (optionnal) parameters if not already
existing
// example, oauth_callback, defined when requesting the token
for (key, value) in parameters {
if key.hasPrefix("oauth_") {
authorizationParameters.updateValue(value, forKey: key)
}
}

    // escape all oauth parameter
    let encodedParam = getEscapedArrayParam(authorizationParameters)
    // convert it into a string, each param separated by &
    var outputStr:String = ""
    for v in encodedParam {
        outputStr += v + "&"
    }
    // remove last "&"
    outputStr.removeAtIndex(outputStr.endIndex.predecessor())
    // percent encode the oauth sorted, appened, parameters
    let percentOutput = self.escapeString(outputStr)

    // build the signature base string
    let urlPercented = self.escapeString(String(url)) //

String(url).stringByAddingPercentEncodingWithAllowedCharacters(.URLHostAllowedCharacterSet())
var signBaseString:String = method + "&" + urlPercented
signBaseString += "&" + percentOutput

    // build the signin key
    let signingKey = self.escapeString( credential.consumer_secret) +

"&" + self.escapeString(credential.oauth_token_secret)

    // Build the signature
    let sha1 = HMAC.sha1(key:

signingKey.dataUsingEncoding(NSUTF8StringEncoding)!, message:
signBaseString.dataUsingEncoding(NSUTF8StringEncoding)!)!
let oauth_signature = sha1.base64EncodedStringWithOptions([])
authorizationParameters.updateValue(self.escapeString(
oauth_signature) , forKey: "oauth_signature")

    // add the signature to the parameters
    //encodedParam.append("oauth_signature=" + oauth_signature )
    //encodedParam.sortInPlace{ $0 < $1 } // not sure it is useful r not

    // create an array, with escape before =
    let newrev = authorizationParameters.sort(){ $0.0 < $1.0 }

    var headerComponents = [String]()
    for (key, value) in newrev {
        headerComponents.append("\(key)=\"\(value)\"")
    }


    let finalUrl:String =  "OAuth " +

headerComponents.joinWithSeparator(",") //
headerComponents.joinWithSeparator(", ")
return finalUrl
}

PArt B:

public func makeRequest(urlString: String, method:
OAuthSwiftHTTPRequest.Method, parameters: [String: AnyObject] = [:],
headers: [String:String]? = nil) -> OAuthSwiftHTTPRequest? {

    let url: String = urlString
    let method: String = "POST"

if let url = NSURL(string: urlString) {
let request = OAuthSwiftHTTPRequest(URL: url, method: method,
parameters: parameters)
if self.credential.oauth2 {
request.headers = ["Authorization": "Bearer
(self.credential.oauth_token)"]
} else {
//let str = ["Authorization": self.encodeParameters(method,
url: url, parameters: parameters, credential: self.credential)]
//request.headers == str
// var str = ["Authorization":
OAuthSwiftClient.authorizationHeaderForMethod(method, url: url, parameters:
parameters, credential: self.credential)]
var str2 = ["Authorization": self.encodeParameters(method,
url: url, parameters: parameters, credential: self.credential)]
request.headers = str2
}
request.successHandler = success
request.failureHandler = failure
request.dataEncoding = dataEncoding
request.encodeParameters = true

        request.HTTPBody = image //

"(image)".dataUsingEncoding(NSUTF8StringEncoding)
request.contentType = "image/jpeg" //type
request.start()

    }

}

in OAuthSwift.swift
in makeRequest (it is now setupRequestForOAuth) :

      if (body != nil && contentType != nil) {

            for (key, value) in nonOAuthParameters {
                request.setValue(value as! String, forHTTPHeaderField:

key)
}

            request.setValue(contentType!, forHTTPHeaderField:

"Content-Type")
//request.setValue(body!.length.description,
forHTTPHeaderField: "Content-Length")
request.HTTPBody = body!
} else {
which replace this :
if let b = body {
request.HTTPBody = b
} else {

the other part of the code are different, but I believe that it is refactor
on your side, as I don't rememmber having updated so much that part.

smugmug need some parameter in the header, even for the upload, if I
remember well what was wrong.

Hope this help.
Olivier

2015-12-13 17:37 GMT+01:00 You shall not pass notifications@github.com:

@fewspider https://github.com/fewspider thank you to look for a
potential identical issue, but for this issue I wait for a sample code with
problem (api, version etc...) from @olivier38070
https://github.com/olivier38070

Some signature problem has been fixed last month

You can open a new issue with the version used of OAuthSwift, the code,
parameters, etc.. and I will test

—
Reply to this email directly or view it on GitHub
https://github.com/OAuthSwift/OAuthSwift/issues/115#issuecomment-164276216
.

@olivier38070 commented on GitHub (Dec 14, 2015): Hi, sorry, I was too busy by my job. now, I updated the code, and it seems that it has evolve a lot. I Will have difficulties to commit anything, as my code also is a fork from an old version, with some modification to work. what do you suggest I do ? I could try to get the latest version, remove all my code in my application and check what if it is working... (I remind that on my side, I could login on smugmug, but I couldn't send/upload any images) here is what gave me trouble : the signature calculation gave me error, in smugmug, when trying to do upload. the code bellow (Part A) is replacing this : public func signatureForMethod(method: OAuthSwiftHTTPRequest.Method, url: NSURL, parameters: Dictionary<String, AnyObject>) -> String { } located in OauthSwiftCredential.swift Also, I had trouble with the encoding of the request, when sending datas : Part A : // convert a Dictionary, in array of string, with escaped string func getEscapedArrayParam(parameters: Dictionary<String, AnyObject>) -> [String] { // escape all oauth parameter var encodedParam = [String]() for(k, v) in parameters { let str = k + "=" + (v as! String) let escapedStr = str.stringByAddingPercentEncodingWithAllowedCharacters(.URLHostAllowedCharacterSet()) encodedParam.append(escapedStr!) } // sort the result encodedParam.sortInPlace{ $0 < $1 } return encodedParam } ``` // do almost like stringByAddingPercentEncodingWithAllowedCharacters, ``` but take in account more character to be changed in %xyz //!_'();:@&=+$,/?%#[] func escapeString(str: String) -> String { let encoding: NSStringEncoding = NSUTF8StringEncoding // !_'();:@&=+$,/?%#[] let charactersToBeEscaped = ":/?&=;+!@#$()',*" as CFStringRef let charactersToLeaveUnescaped = "[]." as CFStringRef let raw: NSString = str let result = CFURLCreateStringByAddingPercentEscapes(kCFAllocatorDefault, raw, charactersToLeaveUnescaped, charactersToBeEscaped, CFStringConvertNSStringEncodingToEncoding(encoding)) return result as String } ``` public func encodeParameters(method: String, url: NSURL, parameters: ``` Dictionary<String, AnyObject>, credential: OAuthSwiftCredential) -> String { ``` // algorithm used : ``` https://dev.twitter.com/oauth/overview/creating-signatures // will add the oauth_signature parameter ``` //define the oauth parameters var authorizationParameters = Dictionary<String, AnyObject>() authorizationParameters["oauth_version"] = OAuth.version authorizationParameters["oauth_consumer_key"] = ``` credential.consumer_key authorizationParameters["oauth_timestamp"] = String(Int64(NSDate().timeIntervalSince1970)) authorizationParameters["oauth_nonce"] = (NSUUID().UUIDString as NSString).substringToIndex(8) authorizationParameters["oauth_signature_method"] = OAuth.signatureMethod // add token is it exist if (credential.oauth_token != ""){ authorizationParameters["oauth_token"] = credential.oauth_token } // add additionnal oauth (optionnal) parameters if not already existing // example, oauth_callback, defined when requesting the token for (key, value) in parameters { if key.hasPrefix("oauth_") { authorizationParameters.updateValue(value, forKey: key) } } ``` // escape all oauth parameter let encodedParam = getEscapedArrayParam(authorizationParameters) // convert it into a string, each param separated by & var outputStr:String = "" for v in encodedParam { outputStr += v + "&" } // remove last "&" outputStr.removeAtIndex(outputStr.endIndex.predecessor()) // percent encode the oauth sorted, appened, parameters let percentOutput = self.escapeString(outputStr) // build the signature base string let urlPercented = self.escapeString(String(url)) // ``` String(url).stringByAddingPercentEncodingWithAllowedCharacters(.URLHostAllowedCharacterSet()) var signBaseString:String = method + "&" + urlPercented signBaseString += "&" + percentOutput ``` // build the signin key let signingKey = self.escapeString( credential.consumer_secret) + ``` "&" + self.escapeString(credential.oauth_token_secret) ``` // Build the signature let sha1 = HMAC.sha1(key: ``` signingKey.dataUsingEncoding(NSUTF8StringEncoding)!, message: signBaseString.dataUsingEncoding(NSUTF8StringEncoding)!)! let oauth_signature = sha1.base64EncodedStringWithOptions([]) authorizationParameters.updateValue(self.escapeString( oauth_signature) , forKey: "oauth_signature") ``` // add the signature to the parameters //encodedParam.append("oauth_signature=" + oauth_signature ) //encodedParam.sortInPlace{ $0 < $1 } // not sure it is useful r not // create an array, with escape before = let newrev = authorizationParameters.sort(){ $0.0 < $1.0 } var headerComponents = [String]() for (key, value) in newrev { headerComponents.append("\(key)=\"\(value)\"") } let finalUrl:String = "OAuth " + ``` headerComponents.joinWithSeparator(",") // headerComponents.joinWithSeparator(", ") return finalUrl } PArt B: public func makeRequest(urlString: String, method: OAuthSwiftHTTPRequest.Method, parameters: [String: AnyObject] = [:], headers: [String:String]? = nil) -> OAuthSwiftHTTPRequest? { ``` let url: String = urlString let method: String = "POST" ``` if let url = NSURL(string: urlString) { let request = OAuthSwiftHTTPRequest(URL: url, method: method, parameters: parameters) if self.credential.oauth2 { request.headers = ["Authorization": "Bearer (self.credential.oauth_token)"] } else { //let str = ["Authorization": self.encodeParameters(method, url: url, parameters: parameters, credential: self.credential)] //request.headers == str // var str = ["Authorization": OAuthSwiftClient.authorizationHeaderForMethod(method, url: url, parameters: parameters, credential: self.credential)] var str2 = ["Authorization": self.encodeParameters(method, url: url, parameters: parameters, credential: self.credential)] request.headers = str2 } request.successHandler = success request.failureHandler = failure request.dataEncoding = dataEncoding request.encodeParameters = true ``` request.HTTPBody = image // ``` "(image)".dataUsingEncoding(NSUTF8StringEncoding) request.contentType = "image/jpeg" //type request.start() ``` } } ``` in OAuthSwift.swift in makeRequest (it is now setupRequestForOAuth) : ``` if (body != nil && contentType != nil) { for (key, value) in nonOAuthParameters { request.setValue(value as! String, forHTTPHeaderField: ``` key) } ``` request.setValue(contentType!, forHTTPHeaderField: ``` "Content-Type") //request.setValue(body!.length.description, forHTTPHeaderField: "Content-Length") request.HTTPBody = body! } else { which replace this : if let b = body { request.HTTPBody = b } else { the other part of the code are different, but I believe that it is refactor on your side, as I don't rememmber having updated so much that part. smugmug need some parameter in the header, even for the upload, if I remember well what was wrong. Hope this help. Olivier 2015-12-13 17:37 GMT+01:00 You shall not pass notifications@github.com: > @fewspider https://github.com/fewspider thank you to look for a > potential identical issue, but for this issue I wait for a sample code with > problem (api, version etc...) from @olivier38070 > https://github.com/olivier38070 > > Some signature problem has been fixed last month > > You can open a new issue with the version used of OAuthSwift, the code, > parameters, etc.. and I will test > > — > Reply to this email directly or view it on GitHub > https://github.com/OAuthSwift/OAuthSwift/issues/115#issuecomment-164276216 > .

kerem commented

Author

Owner

@phimage commented on GitHub (Dec 14, 2015):

@olivier38070 If you make a fork with your code, and say the provider(smugmug) and the method(post)
This is enough for me, no need to try to pull request, yes there is too many change

@phimage commented on GitHub (Dec 14, 2015): @olivier38070 If you make a fork with your code, and say the provider(smugmug) and the method(post) This is enough for me, no need to try to pull request, yes there is too many change

kerem commented

Author

Owner

@olivier38070 commented on GitHub (Dec 14, 2015):

ok, I tried to commit and push, but I have an error with githib.
I don't see what I can do, as other githib are working fine
"You may not have permission to access OAuthSwift. Check Preferences to
make sure you’re still logged in."

2015-12-14 9:54 GMT+01:00 You shall not pass notifications@github.com:

@olivier38070 https://github.com/olivier38070 If you make a fork with
your code, and say the provider(smugmug) and the method(post)
This is enough for me, no need to try to pull request, yes there is too
many change

—
Reply to this email directly or view it on GitHub
https://github.com/OAuthSwift/OAuthSwift/issues/115#issuecomment-164381220
.

@olivier38070 commented on GitHub (Dec 14, 2015): ok, I tried to commit and push, but I have an error with githib. I don't see what I can do, as other githib are working fine "You may not have permission to access OAuthSwift. Check Preferences to make sure you’re still logged in." 2015-12-14 9:54 GMT+01:00 You shall not pass notifications@github.com: > @olivier38070 https://github.com/olivier38070 If you make a fork with > your code, and say the provider(smugmug) and the method(post) > This is enough for me, no need to try to pull request, yes there is too > many change > > — > Reply to this email directly or view it on GitHub > https://github.com/OAuthSwift/OAuthSwift/issues/115#issuecomment-164381220 > .

kerem commented

Author

Owner

@phimage commented on GitHub (Dec 14, 2015):

@olivier38070 are you trying to commit to this repo OAuthSwift/OAuthSwift, not your fork maybe?

I think you must not have the repo with last commit, go to the commit where you begin
for instance start with github.com/olivier38070/OAuthSwift@c6cea89e66 and make a branch, commit into this one

Or if you have a local repo with git and your code, remove your OAuthSwift, create an empty one with same name and push you repo into by adding(or checking if alread added) as remote origin

@phimage commented on GitHub (Dec 14, 2015): @olivier38070 are you trying to commit to this repo OAuthSwift/OAuthSwift, not your fork maybe? I think you must not have the repo with last commit, go to the commit where you begin for instance start with https://github.com/olivier38070/OAuthSwift/commit/c6cea89e66c101dccd20dced608b7f9625d36c36 and make a branch, commit into this one Or if you have a local repo with git and your code, remove your OAuthSwift, create an empty one with same name and push you repo into by adding(or checking if alread added) as remote origin

kerem commented

Author

Owner

@olivier38070 commented on GitHub (Dec 14, 2015):

I tried using sourcetree (which I know) instead of github desktop tool
provided by github....
seems to work.

2015-12-14 12:05 GMT+01:00 You shall not pass notifications@github.com:

@olivier38070 https://github.com/olivier38070 are you trying to commit
to this repo OAuthSwift/OAuthSwift, not your fork maybe?

I think you must not have the repo with last commit, go to the commit
where you begin
for instance start with olivier38070@c6cea89
github.com/olivier38070/OAuthSwift@c6cea89e66

—
Reply to this email directly or view it on GitHub
https://github.com/OAuthSwift/OAuthSwift/issues/115#issuecomment-164410464
.

@olivier38070 commented on GitHub (Dec 14, 2015): I tried using sourcetree (which I know) instead of github desktop tool provided by github.... seems to work. 2015-12-14 12:05 GMT+01:00 You shall not pass notifications@github.com: > @olivier38070 https://github.com/olivier38070 are you trying to commit > to this repo OAuthSwift/OAuthSwift, not your fork maybe? > > I think you must not have the repo with last commit, go to the commit > where you begin > for instance start with olivier38070@c6cea89 > https://github.com/olivier38070/OAuthSwift/commit/c6cea89e66c101dccd20dced608b7f9625d36c36 > > — > Reply to this email directly or view it on GitHub > https://github.com/OAuthSwift/OAuthSwift/issues/115#issuecomment-164410464 > .

kerem commented

Author

Owner

@dbmrq commented on GitHub (Mar 5, 2016):

I was having some trouble with the Goodreads api and #168 didn't fix it, but this did. Is anything still missing for it to be merged? Maybe I could help.

@dbmrq commented on GitHub (Mar 5, 2016): I was having some trouble with the Goodreads api and #168 didn't fix it, but this did. Is anything still missing for it to be merged? Maybe I could help.

kerem commented

Author

Owner

@phimage commented on GitHub (Mar 5, 2016):

@danielbmarques if I understand just adding bracket ( PR #168 for issue #174) do not fix your issues with Goodreads.
You take some code from oliver? you can make a PR if you can, I will read it for sure (here I ask to make a clean one, by merging code from OAuthSwift master)

@phimage commented on GitHub (Mar 5, 2016): @danielbmarques if I understand just adding bracket ( PR #168 for issue #174) do not fix your issues with Goodreads. You take some code from oliver? you can make a PR if you can, I will read it for sure (here I ask to make a clean one, by merging code from OAuthSwift master)

kerem commented

Author

Owner

@dbmrq commented on GitHub (Mar 5, 2016):

Well, it seems I spoke too soon, this didn't actually fix my problem after all.
What I did was to replace my urlEncodedStringWithEncoding with the one in #165. Before I did that the POST request I was trying to make never worked. After I changed the code for Olivier's the request worked and I made my comment here, but now I found out it only works some of the time. Which is very weird… the string that gets signed is exactly the same except for the nonce and the timestamp parameters. Yet it works some of the time, and some of the time it doesn't.
The problem doesn't seem to be with Goodreads either, since the call works in their app (I think they use some objective C library).
I'll keep working on this and make a PR if I can fix it.
@phimage, if you have any ideas about how to debug this, I'm kind of clueless right now, and I don't know much about OAuth.

One thing that I noticed and might be worth mentioning is that the urlEncodedStringWithEncoding() gets called multiple times on the same strings. It gets called, for instance, for each parameter in the urlEncodedQueryStringWithEncoding function, and then those same parameters are passed to that function again when they're part of the whole url.
Edit: I checked the code with the link Olivier mentioned in his first post and after #165 it looks perfect… but I just tested other calls with and without brackets and all my calls that contain brackets in the parameters fail, while the rest of them works.
Edit 2: I think what I said about urlEncodedStringWithEncoding() being called twice might be on the right track… This patch is what makes Goodreads calls with brackets work on Android. It seems they added a way to encode the parameters only sometimes, if I understood correctly.

Thanks for the help and for the great work here.

@dbmrq commented on GitHub (Mar 5, 2016): Well, it seems I spoke too soon, this didn't actually fix my problem after all. What I did was to replace my `urlEncodedStringWithEncoding` with the one in #165. Before I did that the POST request I was trying to make never worked. After I changed the code for Olivier's the request worked and I made my comment here, but now I found out it only works some of the time. Which is very weird… the string that gets signed is exactly the same except for the `nonce` and the `timestamp` parameters. Yet it works some of the time, and some of the time it doesn't. The problem doesn't seem to be with Goodreads either, since the call works in their app (I think they use some objective C library). I'll keep working on this and make a PR if I can fix it. @phimage, if you have any ideas about how to debug this, I'm kind of clueless right now, and I don't know much about OAuth. One thing that I noticed and might be worth mentioning is that the `urlEncodedStringWithEncoding()` gets called multiple times on the same strings. It gets called, for instance, for each parameter in the `urlEncodedQueryStringWithEncoding` function, and then those same parameters are passed to that function again when they're part of the whole url. Edit: I checked the code with the link Olivier mentioned in his first post and after #165 it looks perfect… but I just tested other calls with and without brackets and all my calls that contain brackets in the parameters fail, while the rest of them works. Edit 2: I think what I said about `urlEncodedStringWithEncoding()` being called twice might be on the right track… [This patch](https://github.com/srajko/signpost/commit/1cd201f8b8e1168c48b8cd3fcc6391f706fa469f) is what makes Goodreads calls with brackets work on Android. It seems they added a way to encode the parameters only sometimes, if I understood correctly. Thanks for the help and for the great work here.

kerem commented

Author

Owner

@cschulte22 commented on GitHub (Mar 7, 2016):

I've had similar problems with the signatures not matching. In my case I'm using this on an iPhone app to connect to my own rails application. From what I can tell I've found two separate issues.

The first problem I had was when sent a parameter in a POST or PATCH body that had a newline character \n. I was getting an incorrect signature and the request would fail. #165 fixed that problem for me.

The second problem is when sending a request with square brackets []. Those requests were always generating bad signatures for me. #168 did not fix that issue for me, and also still included the problem with the newline characters.

Since I have control over both ends of the API, I ended up just going with #165 and not sending any parameters with square brackets. Square bracket parameters in rails are pretty much everywhere, so I'm not entirely happy with that solution, but it let me get something out the door for now.

For what it's worth, I did try checking things with the nouncer signature calculator, but I ended up getting 3 different signatures - one from that, one from this OAuthSwift code, and a third from my rails app using the simple_oauth gem. At that point I figured it wasn't worth trying to track down the proper fix since I had no idea who was wrong. Although I'd be inclined to believe that the rails gem is properly handling square brackets, since they're everywhere in rails and someone else would have discovered that issue over there by now.

Anyway, seems to me like the right way to proceed here would be to merge #165 and then see about a separate fix for #174 based off that.

@cschulte22 commented on GitHub (Mar 7, 2016): I've had similar problems with the signatures not matching. In my case I'm using this on an iPhone app to connect to my own rails application. From what I can tell I've found two separate issues. The first problem I had was when sent a parameter in a `POST` or `PATCH` body that had a newline character `\n`. I was getting an incorrect signature and the request would fail. #165 fixed that problem for me. The second problem is when sending a request with square brackets `[]`. Those requests were always generating bad signatures for me. #168 did _not_ fix that issue for me, and also still included the problem with the newline characters. Since I have control over both ends of the API, I ended up just going with #165 and not sending any parameters with square brackets. Square bracket parameters in rails are pretty much everywhere, so I'm not entirely happy with that solution, but it let me get something out the door for now. For what it's worth, I did try checking things with the [nouncer signature calculator](http://nouncer.com/oauth/signature.html), but I ended up getting 3 different signatures - one from that, one from this OAuthSwift code, and a third from my rails app using the [simple_oauth](https://github.com/laserlemon/simple_oauth) gem. At that point I figured it wasn't worth trying to track down the proper fix since I had no idea who was wrong. Although I'd be inclined to believe that the rails gem is properly handling square brackets, since they're everywhere in rails and someone else would have discovered that issue over there by now. Anyway, seems to me like the right way to proceed here would be to merge #165 and then see about a separate fix for #174 based off that.

kerem commented

Author

Owner

@dbmrq commented on GitHub (Mar 8, 2016):

Ok, I fixed other problems in my code and now it works with both #165 and #168.

It seems to me like the main difference between those two is that in #165 some of the excluded characters aren't mentioned explicitly: they're taken from URLQueryAllowedCharacterSet.

In both cases it's not clear what the allowed characters are. #165 uses URLQueryAllowedCharacterSet, whose contents aren't immediately clear, and #168 (as the original code) uses an invertedSet, which makes clear what characters are excluded, but not which characters are allowed.

The OAuth 1.0 specification, on the other hand, is very clear about what is allowed:

Characters in the unreserved character set as defined by [RFC3986], Section 2.3 (ALPHA, DIGIT, "-", ".", "_", "~") MUST NOT be encoded.

All other characters MUST be encoded.

So I think it would be a lot better to explicitly state the allowed characters.
I modified my code to do just that:

func urlEncodedStringWithEncoding(encoding: NSStringEncoding) -> String {
    let originalString: NSString = self
    let customAllowedSet =  NSCharacterSet(charactersInString:"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~")
    let escapedString = originalString.stringByAddingPercentEncodingWithAllowedCharacters(customAllowedSet)
    return escapedString! as String
}

Since the OAuth specification is so clear, I think this is pretty safe to do, and it works perfectly for me.
@phimage, should I make a PR with that change?

@dbmrq commented on GitHub (Mar 8, 2016): Ok, I fixed other problems in my code and now it works with both #165 and #168. It seems to me like the main difference between those two is that in #165 some of the excluded characters aren't mentioned explicitly: they're taken from `URLQueryAllowedCharacterSet`. In both cases it's not clear what the allowed characters are. #165 uses `URLQueryAllowedCharacterSet`, whose contents aren't immediately clear, and #168 (as the original code) uses an `invertedSet`, which makes clear what characters are _excluded_, but not which characters are _allowed_. [The OAuth 1.0 specification](https://tools.ietf.org/html/rfc5849), on the other hand, is very clear about _what is allowed_: > - Characters in the unreserved character set as defined by [[RFC3986], Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3) (ALPHA, DIGIT, "-", ".", "_", "~") MUST NOT be encoded. > - All other characters MUST be encoded. So I think it would be a lot better to _explicitly state the allowed characters_. I modified my code to do just that: ``` swift func urlEncodedStringWithEncoding(encoding: NSStringEncoding) -> String { let originalString: NSString = self let customAllowedSet = NSCharacterSet(charactersInString:"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~") let escapedString = originalString.stringByAddingPercentEncodingWithAllowedCharacters(customAllowedSet) return escapedString! as String } ``` Since the OAuth specification is so clear, I think this is pretty safe to do, and it works perfectly for me. @phimage, should I make a PR with that change?

kerem commented

Author

Owner

@cschulte22 commented on GitHub (Mar 8, 2016):

@danielbmarques I rebuilt my app using your changes - the newline problem didn't happen but I still had issues with the square brackets. That leads me to believe that the problem is most likely on my end, not in this OAuthSwift code.

I'm in favor of your solution though since it matches the spec. I'll post back here if I ever track down the issue on my end.

@cschulte22 commented on GitHub (Mar 8, 2016): @danielbmarques I rebuilt my app using your changes - the newline problem didn't happen but I still had issues with the square brackets. That leads me to believe that the problem is most likely on my end, not in this OAuthSwift code. I'm in favor of your solution though since it matches the spec. I'll post back here if I ever track down the issue on my end.

kerem commented

Author

Owner

@phimage commented on GitHub (Mar 8, 2016):

@danielbmarques thanks you to point out the info from RFC
I have just a doubt because one day I make a comment about information from RFC and the difference in OAuthSwift implemention. (Maybe two method must be created, one for the signature, one other to encode elsewhere, and maybe that"s why there is double encoding sometimes...)
I will look into PR and issues for this comment

@phimage commented on GitHub (Mar 8, 2016): @danielbmarques thanks you to point out the info from RFC I have just a doubt because one day I make a comment about information from RFC and the difference in OAuthSwift implemention. (Maybe two method must be created, one for the signature, one other to encode elsewhere, and maybe that"s why there is double encoding sometimes...) I will look into PR and issues for this comment

kerem commented

Author

Owner

@dbmrq commented on GitHub (Mar 9, 2016):

@phimage, oh, it seems you're right. That info is actually from the OAuth 1.0 specification (from what I understand it's a little more strict than RFC3986), and it refers to both the signature base string and the encoding of parameters for the header.

It does add a caveat, though:

This method is different from the encoding scheme used by the "application/x-www-form-urlencoded" content-type (for example, it encodes space characters as "%20" and not using the "+" character).

I think that only applies for a request's HTTPBody, right? From what I saw in the code the parameters are added to the body in the setupRequestForOAuth() method of the OAuthSwiftHTTPRequest class, so we'd have to add a different method just for the encoding of the parameters that go in the body.

If that's the case, this is already broken with the current code, though. The spaces sent in the body, for instance, are currently encoded as "%20", not as "+".
So my code wouldn't really change anything about that and it would be safe to change it already.
From what I gather the code that goes in the body must be encoded differently, but at least for me it doesn't matter much: I'm using it as it is, with the spaces encoded incorrectly, but everything is working fine, even when I send spaces inside a parameter's value.

As for the double encoding, I looked into it further and I think that's actually right: http://stackoverflow.com/a/3292691/3539651

Anyway, let me know if/when you want me to make a PR for the changes in the urlEncodedStringWithEncoding() method… and I can also help writing a different one for the encoding of the body if you decide that's the way to go.

@cschulte22, from what I gathered from the Goodreads forums there are a lot of problems with the encoding of brackets in many different clients. Besides that, according to them servers aren't always consistent in the way they decode the brackets, and what works for one may not work for another.
I think it would be a good idea to try debugging your calls in another client, like Chrome's Postman extension, and if your requests work from there your problem is likely somewhere else on your code. If you can't get it to work in other clients, maybe your server decodes things differently… you could try it with the brackets encoded just once (as I said, they're encoded twice in the signature base string), I don't know.
Whether it's with #165, #168 or with my fix, I am now getting proper signatures that match the link Olivier mentioned in the original post, and my calls also match the ones made by the Postman extension and by Paw, a REST client for Mac.
Good luck. :)

@dbmrq commented on GitHub (Mar 9, 2016): @phimage, oh, it seems you're right. That info is actually from the OAuth 1.0 specification (from what I understand it's a little more strict than RFC3986), and it refers to both the _signature base string_ and the encoding of _parameters_ for the header. It does add a caveat, though: > This method is different from the encoding scheme used by the "application/x-www-form-urlencoded" content-type (for example, it encodes space characters as "%20" and not using the "+" character). I think that only applies for a request's HTTPBody, right? From what I saw in the code the parameters are added to the body in the `setupRequestForOAuth()` method of the `OAuthSwiftHTTPRequest` class, so we'd have to add a different method just for the encoding of the parameters that go in the body. If that's the case, this is already broken with the current code, though. The spaces sent in the body, for instance, are currently encoded as "%20", not as "+". So my code wouldn't really change anything about that and it would be safe to change it already. From what I gather the code that goes in the body must be encoded differently, but at least for me it doesn't matter much: I'm using it as it is, with the spaces encoded incorrectly, but everything is working fine, even when I send spaces inside a parameter's value. As for the double encoding, I looked into it further and I think that's actually right: http://stackoverflow.com/a/3292691/3539651 Anyway, let me know if/when you want me to make a PR for the changes in the `urlEncodedStringWithEncoding()` method… and I can also help writing a different one for the encoding of the body if you decide that's the way to go. --- @cschulte22, from what I gathered from the Goodreads forums there are a lot of problems with the encoding of brackets in many different clients. Besides that, according to them servers aren't always consistent in the way they decode the brackets, and what works for one may not work for another. I think it would be a good idea to try debugging your calls in another client, like Chrome's Postman extension, and if your requests work from there your problem is likely somewhere else on your code. If you can't get it to work in other clients, maybe your server decodes things differently… you could try it with the brackets encoded just once (as I said, they're encoded twice in the signature base string), I don't know. Whether it's with #165, #168 or with my fix, I am now getting proper signatures that match the link Olivier mentioned in the original post, and my calls also match the ones made by the Postman extension and by Paw, a REST client for Mac. Good luck. :)

kerem commented

Author

Owner

@phimage commented on GitHub (Mar 9, 2016):

@danielbmarques you can make a PR at anytime

ps: For Goodreads if a solution is found an option could be added

@phimage commented on GitHub (Mar 9, 2016): @danielbmarques you can make a PR at anytime ps: For Goodreads if a solution is found an option could be added

kerem commented

Author

Owner

@dbmrq commented on GitHub (Mar 9, 2016):

@phimage Done. :) #201

I'll add a Goodreads example to the demo when I have the time.

@dbmrq commented on GitHub (Mar 9, 2016): @phimage Done. :) #201 I'll add a Goodreads example to the demo when I have the time.

kerem commented

Author

Owner

@phimage commented on GitHub (Mar 9, 2016):

thanks you for your work on this

I keep this issue open to discuss about signature for the moment

And maybe when I have time make some tests on other services or just execute basic tests

@phimage commented on GitHub (Mar 9, 2016): thanks you for your work on this I keep this issue open to discuss about signature for the moment And maybe when I have time make some tests on other services or just execute basic tests

kerem commented

Author

Owner

@cschulte22 commented on GitHub (Mar 15, 2016):

Alright, finally tracked my issue down to code on my server. Thanks @danielbmarques for the recommendations on Postman and Paw. Turns out that OAuthSwift was generating proper signatures for me.

The problem on my server was that I was generating my signature using the parsed parameter hash (i.e. conversation[subject]=something was turning into {conversation: {subject: 'something'}}). When I updated my server to use the decoded raw post data instead of the parameter hash it fixed the incorrect signatures.

@cschulte22 commented on GitHub (Mar 15, 2016): Alright, finally tracked my issue down to code on my server. Thanks @danielbmarques for the recommendations on Postman and Paw. Turns out that OAuthSwift was generating proper signatures for me. The problem on my server was that I was generating my signature using the parsed parameter hash (i.e. `conversation[subject]=something` was turning into `{conversation: {subject: 'something'}}`). When I updated my server to use the decoded raw post data instead of the parameter hash it fixed the incorrect signatures.

kerem commented