c# - 在 OAuth 不起作用的情况下在 OpenPaths.cc api 调用中传递查询字符串参数

Question

我正在尝试调用 OpenPaths.cc rest service API这需要两条腿的 OAuth。为此，我使用 DevDefined.OAuth library (我尝试了 nuget 包和来自 github 的最新包)。当我不在查询字符串中传递参数时它起作用，但当我传递参数时返回 400 NOT AUTHORIZED。

没有参数的工作示例:

public class OpenPathsRequest
{
    private const string accessKey = "your personal access key";
    private const string secretKey = "your personal secret";
    private const string url = "https://openpaths.cc/api/1";
    private OAuthSession session;

    public OpenPathsRequest()
    {
        var consumerContext = new OAuthConsumerContext
        {
            ConsumerKey = accessKey,
            ConsumerSecret = secretKey,
            SignatureMethod = SignatureMethod.HmacSha1,
            UseHeaderForOAuthParameters = true
        };
        session = new OAuthSession(consumerContext, url, url, url);
    }

    private string GetWebResponseAsString(HttpWebResponse response)
    {
        Encoding enc = System.Text.Encoding.GetEncoding(1252);
        StreamReader loResponseStream = new StreamReader(response.GetResponseStream(), enc);
        return loResponseStream.ReadToEnd();
    }

    public string GetResponse()
    {
        HttpWebResponse response = session.Request().Get().ForUrl(url).ToWebResponse();
        var result = GetWebResponseAsString(response);
        return result;
    }
}

class Program
{
  static void Main(string[] args)
  {
      // create new OpenPathsRequest and get result
      var request = new OpenPathsRequest();
      var response = request.GetResponse();
      Console.WriteLine(response);
      Console.WriteLine("Press any key...");
      Console.ReadKey();
  }
}

但是当我像这样更改 GetResponse 方法并传入 2 个参数(start_time 和 end_time)时:

public string GetResponse()
{            
    HttpWebResponse response = session.Request().Get().ForUrl(url).WithQueryParameters(
        new { start_time = 1364962612, end_time = 1364991412  }).ToWebResponse();
    var result = GetWebResponseAsString(response);
    return result;
}

这会导致以下 HTTP 请求(省略消费者 key ):

GET https://openpaths.cc/api/1?start_time=1364962612&end_time=1364991412 HTTP/1.1
Authorization: OAuth oauth_nonce="7b5da37a-6227-4ded-ae8b-a695e789ef90",oauth_consumer_key="**********",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1365058952",oauth_version="1.0",oauth_signature="tAk4KMj%2FsiG6BTLSmvDNKXbBpNs%3D"
Host: openpaths.cc
Connection: Keep-Alive

我收到错误响应:

HTTP/1.1 400 Bad Request
Date: Thu, 04 Apr 2013 07:03:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Content-Length: 19
Server: TornadoServer/2.0
Set-Cookie: _xsrf=bf20487382b64eeb8646d31b0770db85; Path=/
Set-Cookie: session_id=ZTk2Mjk1MzIzNWNiMmRjMTY1ZmY5Y2ExNWUwMGY5ZTAxZmY1NGIyODljZGJiNzRlMmIyMWI4NTA3YzUwYWJlYg==|1365059006|7459a7ff95039279e9686ceb76b58918fd9f3e48; expires=Thu, 04 Apr 2013 07:18:26 GMT; Path=/

400: NOT AUTHORIZED

非常感谢所有帮助。提前致谢。

哈门

Answer 1

解决了!显然，OpenPaths.cc api 需要在签名基本字符串中没有附加查询参数的情况下进行签名。我相信这不符合 OAuth 规范，是吗？无论如何，使用 DevDefined.OAuth 我可以通过在调用 WithQueryParameters 之前调用 SignWithoutToken 来轻松解决这个问题，如下所示:

public string GetResponse()
{            
    HttpWebResponse response = session.Request().Get().ForUrl(url).
        SignWithoutToken().
        WithQueryParameters(new { start_time = 1364962612, end_time = 1364991412  }).
        ToWebResponse();
    var result = GetWebResponseAsString(response);
    return result;
}