[GH-ISSUE #142] Additional parameters on the querystring are not being factored into OAuth signature. #89

New issue

Closed

opened 2026-03-03 16:45:35 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 16:45:35 +03:00

Owner

Originally created by @pculligan on GitHub (Nov 9, 2015).
Original GitHub issue: https://github.com/OAuthSwift/OAuthSwift/issues/142

I came across a case where the URL to GET a request token had additional querystring parameters.

https://apicert.client.com/platform/oauth/request_token?xoauth_displayname=Apply%20Mobile&scope=https%3A%2F%2Fapicert.client.com%2Fplatform%2F HTTP/1.1

However, these parameters are not currently accounted for when generating the OAuth signature.

This is arguably ok in the case of URLs where we can assume that educating the user on not having querysting parameters, but cannot be accepted in the case of the request, authorize, or access methods during OAuth negotiation (the method authorizeWithCallbackURL, postOAuthRequestTokenWithCallbackURL and postOAuthAccessTokenWithRequestToken don't support parameters).

The OAuth1.0 spec states that the OAuth signature must account for all of the parameters and the URL portion of the signature base string must only be the scheme, query, and path.

Originally created by @pculligan on GitHub (Nov 9, 2015). Original GitHub issue: https://github.com/OAuthSwift/OAuthSwift/issues/142 I came across a case where the URL to GET a request token had additional querystring parameters. ``` https://apicert.client.com/platform/oauth/request_token?xoauth_displayname=Apply%20Mobile&scope=https%3A%2F%2Fapicert.client.com%2Fplatform%2F HTTP/1.1 ``` However, these parameters are not currently accounted for when generating the OAuth signature. This is arguably ok in the case of URLs where we can assume that educating the user on not having querysting parameters, but cannot be accepted in the case of the request, authorize, or access methods during OAuth negotiation (the method `authorizeWithCallbackURL`, `postOAuthRequestTokenWithCallbackURL` and `postOAuthAccessTokenWithRequestToken` don't support parameters). The OAuth1.0 spec states that the OAuth signature must account for all of the parameters and the URL portion of the signature base string must only be the scheme, query, and path.