objective-c - 脂肪 secret API "invalid signature"

Question

使用这个 repository当必须提供 oauth_token 时，我无法进行查询。我总是得到无效的签名。在代码中尝试了很多解决方案和调整，但没有任何效果。请帮忙。

这是来自提到的 git 的代码:

NSString *OAuthorizationHeader(NSURL *url, NSString *method, NSData *body, NSString *_oAuthConsumerKey, NSString *_oAuthConsumerSecret, NSString *_oAuthToken, NSString *_oAuthTokenSecret)
{
    NSString *_oAuthNonce = [NSString ab_GUID];
    NSString *_oAuthTimestamp = [NSString stringWithFormat:@"%d", (int)[[NSDate date] timeIntervalSince1970]];
    NSString *_oAuthSignatureMethod = @"HMAC-SHA1";
    NSString *_oAuthVersion = @"1.0";

    NSMutableDictionary *oAuthAuthorizationParameters = [NSMutableDictionary dictionary];
    [oAuthAuthorizationParameters setObject:_oAuthNonce forKey:@"oauth_nonce"];
    [oAuthAuthorizationParameters setObject:_oAuthTimestamp forKey:@"oauth_timestamp"];
    [oAuthAuthorizationParameters setObject:_oAuthSignatureMethod forKey:@"oauth_signature_method"];
    [oAuthAuthorizationParameters setObject:_oAuthVersion forKey:@"oauth_version"];
    [oAuthAuthorizationParameters setObject:_oAuthConsumerKey forKey:@"oauth_consumer_key"];
    if(_oAuthToken)
        [oAuthAuthorizationParameters setObject:_oAuthToken forKey:@"oauth_token"];

    // get query and body parameters
    NSDictionary *additionalQueryParameters = [NSURL ab_parseURLQueryString:[url query]];
    NSDictionary *additionalBodyParameters = nil;
    if(body) {
        NSString *string = [[NSString alloc] initWithData:body encoding:NSUTF8StringEncoding];
        if(string) {
            additionalBodyParameters = [NSURL ab_parseURLQueryString:string];
        }
    }

    // combine all parameters
    NSMutableDictionary *parameters = [oAuthAuthorizationParameters mutableCopy];
    if(additionalQueryParameters) [parameters addEntriesFromDictionary:additionalQueryParameters];
    if(additionalBodyParameters) [parameters addEntriesFromDictionary:additionalBodyParameters];

    // -> UTF-8 -> RFC3986
    NSMutableDictionary *encodedParameters = [NSMutableDictionary dictionary];
    for(NSString *key in parameters) {
        NSString *value = [parameters objectForKey:key];
        [encodedParameters setObject:[value ab_RFC3986EncodedString] forKey:[key ab_RFC3986EncodedString]];
    }

    NSArray *sortedKeys = [[encodedParameters allKeys] sortedArrayUsingFunction:SortParameter context:(__bridge void *)(encodedParameters)];

    NSMutableArray *parameterArray = [NSMutableArray array];
    for(NSString *key in sortedKeys) {
        [parameterArray addObject:[NSString stringWithFormat:@"%@=%@", key, [encodedParameters objectForKey:key]]];
    }
    NSString *normalizedParameterString = [parameterArray componentsJoinedByString:@"&"];

    NSLog(@"normalizedParameters: %@", normalizedParameterString);

    NSString *normalizedURLString;
    if ([url port] == nil) {
        normalizedURLString = [NSString stringWithFormat:@"%@://%@%@", [url scheme], [url host], [url path]];
    } else {
        normalizedURLString = [NSString stringWithFormat:@"%@://%@:%@%@", [url scheme], [url host], [url port], [url path]];
    }

    NSString *signatureBaseString = [NSString stringWithFormat:@"%@&%@&%@",
                                     [method ab_RFC3986EncodedString],
                                     [normalizedURLString ab_RFC3986EncodedString],
                                     [normalizedParameterString ab_RFC3986EncodedString]];

    NSLog(@"signature base: %@", signatureBaseString);

    NSString *key = [NSString stringWithFormat:@"%@&%@&",
                     [_oAuthConsumerSecret ab_RFC3986EncodedString],
                     [_oAuthTokenSecret ab_RFC3986EncodedString]];

    NSLog(@"key codes: %@", key);

    NSData *signature = HMAC_SHA1(signatureBaseString, key);
    NSString *base64Signature = [signature base64EncodedString];

    // PARKER CHANGE: changed oAuthAuthorizationParameters to parameters
    NSMutableDictionary *authorizationHeaderDictionary = [parameters mutableCopy];
    [authorizationHeaderDictionary setObject:base64Signature forKey:@"oauth_signature"];

    NSMutableArray *authorizationHeaderItems = [NSMutableArray array];
    for(NSString *key in authorizationHeaderDictionary) {
        NSString *value = [authorizationHeaderDictionary objectForKey:key];

        NSLog(@"KEY: %@", key);
        NSLog(@"VALUE: %@", value);
        // PARKER CHANGE: removed quotes that surrounded each value
        [authorizationHeaderItems addObject:[NSString stringWithFormat:@"%@=%@",
                                             [key ab_RFC3986EncodedString],
                                             [value ab_RFC3986EncodedString]]];
    }

    // PARKER CHANGE: changed concatentation string from ", " to "&"
    NSString *authorizationHeaderString = [authorizationHeaderItems componentsJoinedByString:@"&"];
//  authorizationHeaderString = [NSString stringWithFormat:@"OAuth %@", authorizationHeaderString];

    NSLog(@"final: %@", authorizationHeaderString);

    return authorizationHeaderString;
}

我是这样调用它的:

- (void) makeUserRequestWithMethod:(NSString *)method
                    parameters:(NSDictionary *)params
                    completion:(void (^)(NSDictionary *data))completionBlock {

    NSLog(@"%s", __func__);

    NSMutableDictionary *parameters = [params mutableCopy];
    [parameters addEntriesFromDictionary:[self defaultParameters]];
    [parameters addEntriesFromDictionary:@{ @"method" : method }];

    NSString *queryString = [self queryStringFromDictionary:parameters];
    NSData *data          = [NSData dataWithBytes:[queryString UTF8String] length:queryString.length];
    NSString *authHeader  = OAuthorizationHeader([NSURL URLWithString:FAT_SECRET_API_ENDPOINT],
                                                 @"POST",
                                                 data,
                                                 _oauthConsumerKey,
                                                 _oauthConsumerSecret,
                                                 _oAuthToken,
                                                 _oAuthTokenSecret
                                                 );

    NSLog(@"header: %@", authHeader);

    NSURL *url = [NSURL URLWithString:[FAT_SECRET_API_ENDPOINT stringByAppendingFormat:@"?%@", authHeader]];
    [[[NSURLSession sharedSession] dataTaskWithURL:url completionHandler:^(NSData * _Nullable data, NSURLResponse * _Nullable response, NSError * _Nullable error) {
        if (data) {
            id JSON = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
            completionBlock(JSON);
        } else {
            completionBlock(nil);
        }
    }] resume];
}

Answer 1

我要冒昧地说，其他人证明有效的代码在这里可能没有错，而是先看看你自己的代码。您说错误消息是“无效签名”，这听起来像是来自您调用的服务器的警告，而不是来自您正在使用的代码的警告。

[parameters addEntriesFromDictionary:[self defaultParameters]];
[parameters addEntriesFromDictionary:@{ @"method" : method }];

NSString *queryString = [self queryStringFromDictionary:parameters];

[self defaultParameters] 内部发生了什么，您是否 100% 确定参数适合您调用的 API(包括拼写)？

您是否已验证 [self queryStringFromDictionary:parameters] 准备了格式正确的查询字符串，并且没有引入一些错误(例如，非转义特殊字符或百分比编码)？