android - OAuth 生成签名

Question

我正在尝试为 OAuth 请求生成签名。这是我的做法:

String toHash = URLEncoder.encode("POST&https://" + url + "&oauth_callback=oob&oauth_consumer_key=" + key + "&oauth_signature_method=HMAC-SHA1&oauth_timestamp=" + timeStamp + "&oauth_nonce=" + timeStamp);

String hash = computeHmac(toHash, secret);

...

public String computeHmac(String baseString, String key)
    {
        Mac mac = Mac.getInstance("HmacSHA1");
        SecretKeySpec secret = new SecretKeySpec(key.getBytes(), mac.getAlgorithm());
        mac.init(secret);
        byte[] digest = mac.doFinal(baseString.getBytes());
        return new String(Base64.encodeBase64(digest));
    }

但是服务器告诉我签名错误。我做错了什么？请帮忙...

Answer 1

根据 OAuth 规范:

The signature base string is constructed by concatenating together,in order, the following HTTP request elements:

1. The HTTP request method in uppercase. For example: "HEAD","GET", "POST", etc. If the request uses a custom HTTP method, itMUST be encoded (Section 3.6).

2. An "&" character (ASCII code 38).

3. The base string URI from Section 3.4.1.2, after being encoded(Section 3.6).

4. An "&" character (ASCII code 38).

5. The request parameters as normalized in Section 3.4.1.3.2, afterbeing encoded (Section 3.6).

在您的基本字符串中，某些字符未正确编码和规范化。例如:

https://             ->   https%3A%2F%2F
oauth_callback=oob   ->   oauth_callback%3Doob
...

有关字符串构造的所有详细信息都在这里:https://www.rfc-editor.org/rfc/rfc5849#section-3.4.1.1