JavaScript/HTML - Container

Re: OAuth, getting it to work

killer10 — Mon, 26 Oct 2009 22:08:28 GMT

App_Code/OAuthBase.cs:

using System;
using System.Security.Cryptography;
using System.Collections.Generic;
using System.Text;
using System.Web;

namespace OAuth
{
    public class OAuthBase
    {

        /// <summary>
        /// Provides a predefined set of algorithms that are supported officially by the protocol
        /// </summary>
        public enum SignatureTypes
        {
            HMACSHA1,
            PLAINTEXT,
            RSASHA1
        }

        /// <summary>
        /// Provides an internal structure to sort the query parameter
        /// </summary>
        protected class QueryParameter
        {
            private string name = null;
            private string value = null;

            public QueryParameter(string name, string value)
            {
                this.name = name;
                this.value = value;
            }

            public string Name
            {
                get { return name; }
            }

            public string Value
            {
                get { return value; }
            }
        }

        /// <summary>
        /// Comparer class used to perform the sorting of the query parameters
        /// </summary>
        protected class QueryParameterComparer : IComparer<QueryParameter>
        {

            #region IComparer<QueryParameter> Members

            public int Compare(QueryParameter x, QueryParameter y)
            {
                if (x.Name == y.Name)
                {
                    return string.Compare(x.Value, y.Value);
                }
                else
                {
                    return string.Compare(x.Name, y.Name);
                }
            }

            #endregion
        }

        protected const string OAuthVersion = "1.0";
        protected const string OAuthParameterPrefix = "oauth_";

        //
        // List of know and used oauth parameters' names
        //
        protected const string OAuthConsumerKeyKey = "oauth_consumer_key";
        protected const string OAuthCallbackKey = "oauth_callback";
        protected const string OAuthVersionKey = "oauth_version";
        protected const string OAuthSignatureMethodKey = "oauth_signature_method";
        protected const string OAuthSignatureKey = "oauth_signature";
        protected const string OAuthTimestampKey = "oauth_timestamp";
        protected const string OAuthNonceKey = "oauth_nonce";
        protected const string OAuthTokenKey = "oauth_token";
        protected const string OAuthTokenSecretKey = "oauth_token_secret";

        protected const string HMACSHA1SignatureType = "HMAC-SHA1";
        protected const string PlainTextSignatureType = "PLAINTEXT";
        protected const string RSASHA1SignatureType = "RSA-SHA1";

        protected Random random = new Random();

        public string unreservedChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~";

        /// <summary>
        /// Helper function to compute a hash value
        /// </summary>
        /// <param name="hashAlgorithm">The hashing algoirhtm used. If that algorithm needs some initialization, like HMAC and its derivatives, they should be initialized prior to passing it to this function</param>
        /// <param name="data">The data to hash</param>
        /// <returns>a Base64 string of the hash value</returns>
        private string ComputeHash(HashAlgorithm hashAlgorithm, string data)
        {
            if (hashAlgorithm == null)
            {
                throw new ArgumentNullException("hashAlgorithm");
            }

            if (string.IsNullOrEmpty(data))
            {
                throw new ArgumentNullException("data");
            }

            byte[ dataBuffer = System.Text.Encoding.ASCII.GetBytes(data);
            byte[ hashBytes = hashAlgorithm.ComputeHash(dataBuffer);

            return Convert.ToBase64String(hashBytes);
        }

        /// <summary>
        /// Internal function to cut out all non oauth query string parameters (all parameters not begining with "oauth_")
        /// </summary>
        /// <param name="parameters">The query string part of the Url</param>
        /// <returns>A list of QueryParameter each containing the parameter name and value</returns>
        private List<QueryParameter> GetQueryParameters(string parameters)
        {
            if (parameters.StartsWith("?"))
            {
                parameters = parameters.Remove(0, 1);
            }

            List<QueryParameter> result = new List<QueryParameter>();

            if (!string.IsNullOrEmpty(parameters))
            {
                string[ p = parameters.Split('&');
                foreach (string s in p)
                {
                    if (!string.IsNullOrEmpty(s) && !s.StartsWith(OAuthParameterPrefix))
                    {
                        if (s.IndexOf('=') > -1)
                        {
                            string[ temp = s.Split('=');
                            result.Add(new QueryParameter(temp[0], temp[1]));
                        }
                        else
                        {
                            result.Add(new QueryParameter(s, string.Empty));
                        }
                    }
                }
            }

            return result;
        }

        /// <summary>
        /// This is a different Url Encode implementation since the default .NET one outputs the percent encoding in lower case.
        /// While this is not a problem with the percent encoding spec, it is used in upper case throughout OAuth
        /// </summary>
        /// <param name="value">The value to Url encode</param>
        /// <returns>Returns a Url encoded string</returns>
        public string UrlEncode(string value)
        {
            StringBuilder result = new StringBuilder();

            foreach (char symbol in value)
            {
                if (unreservedChars.IndexOf(symbol) != -1)
                {
                    result.Append(symbol);
                }
                else
                {
                    result.Append('%' + String.Format("{0:X2}", (int)symbol));
                }
            }

            return result.ToString();
        }

        /// <summary>
        /// Normalizes the request parameters according to the spec
        /// </summary>
        /// <param name="parameters">The list of parameters already sorted</param>
        /// <returns>a string representing the normalized parameters</returns>
        protected string NormalizeRequestParameters(IList<QueryParameter> parameters)
        {
            StringBuilder sb = new StringBuilder();
            QueryParameter p = null;
            for (int i = 0; i < parameters.Count; i++)
            {
                p = parameters;
                sb.AppendFormat("{0}={1}", p.Name, p.Value);

                if (i < parameters.Count - 1)
                {
                    sb.Append("&");
                }
            }

            return sb.ToString();
        }

        /// <summary>
        /// Generate the signature base that is used to produce the signature
        /// </summary>
        /// <param name="url">The full url that needs to be signed including its non OAuth url parameters</param>
        /// <param name="consumerKey">The consumer key</param>
        /// <param name="token">The token, if available. If not available pass null or an empty string</param>
        /// <param name="tokenSecret">The token secret, if available. If not available pass null or an empty string</param>
        /// <param name="httpMethod">The http method used. Must be a valid HTTP method verb (POST,GET,PUT, etc)</param>
        /// <param name="signatureType">The signature type. To use the default values use <see cref="OAuthBase.SignatureTypes">OAuthBase.SignatureTypes</see>.</param>
        /// <returns>The signature base</returns>
        public string GenerateSignatureBase(Uri url, string consumerKey, string token, string tokenSecret, string httpMethod, string timeStamp, string nonce, string signatureType, out string normalizedUrl, out string normalizedRequestParameters)
        {
            if (token == null)
            {
                token = string.Empty;
            }

            if (tokenSecret == null)
            {
                tokenSecret = string.Empty;
            }

            if (string.IsNullOrEmpty(consumerKey))
            {
                throw new ArgumentNullException("consumerKey");
            }

            if (string.IsNullOrEmpty(httpMethod))
            {
                throw new ArgumentNullException("httpMethod");
            }

            if (string.IsNullOrEmpty(signatureType))
            {
                throw new ArgumentNullException("signatureType");
            }

            normalizedUrl = null;
            normalizedRequestParameters = null;

            List<QueryParameter> parameters = GetQueryParameters(url.Query);
            parameters.Add(new QueryParameter(OAuthVersionKey, OAuthVersion));
            parameters.Add(new QueryParameter(OAuthNonceKey, nonce));
            parameters.Add(new QueryParameter(OAuthTimestampKey, timeStamp));
            parameters.Add(new QueryParameter(OAuthSignatureMethodKey, signatureType));
            parameters.Add(new QueryParameter(OAuthConsumerKeyKey, consumerKey));

            if (!string.IsNullOrEmpty(token))
            {
                parameters.Add(new QueryParameter(OAuthTokenKey, token));
            }

            parameters.Sort(new QueryParameterComparer());

            normalizedUrl = string.Format("{0}://{1}", url.Scheme, url.Host);
            if (!((url.Scheme == "http" && url.Port == 80) || (url.Scheme == "https" && url.Port == 443)))
            {
                normalizedUrl += ":" + url.Port;
            }
            normalizedUrl += url.AbsolutePath;
            normalizedRequestParameters = NormalizeRequestParameters(parameters);

            StringBuilder signatureBase = new StringBuilder();
            signatureBase.AppendFormat("{0}&", httpMethod.ToUpper());
            signatureBase.AppendFormat("{0}&", UrlEncode(normalizedUrl));
            signatureBase.AppendFormat("{0}", UrlEncode(normalizedRequestParameters));

            return signatureBase.ToString();
        }

        /// <summary>
        /// Generate the signature value based on the given signature base and hash algorithm
        /// </summary>
        /// <param name="signatureBase">The signature based as produced by the GenerateSignatureBase method or by any other means</param>
        /// <param name="hash">The hash algorithm used to perform the hashing. If the hashing algorithm requires initialization or a key it should be set prior to calling this method</param>
        /// <returns>A base64 string of the hash value</returns>
        public string GenerateSignatureUsingHash(string signatureBase, HashAlgorithm hash)
        {
            return ComputeHash(hash, signatureBase);
        }

        /// <summary>
        /// Generates a signature using the HMAC-SHA1 algorithm
        /// </summary>
        /// <param name="url">The full url that needs to be signed including its non OAuth url parameters</param>
        /// <param name="consumerKey">The consumer key</param>
        /// <param name="consumerSecret">The consumer seceret</param>
        /// <param name="token">The token, if available. If not available pass null or an empty string</param>
        /// <param name="tokenSecret">The token secret, if available. If not available pass null or an empty string</param>
        /// <param name="httpMethod">The http method used. Must be a valid HTTP method verb (POST,GET,PUT, etc)</param>
        /// <returns>A base64 string of the hash value</returns>
        public string GenerateSignature(Uri url, string consumerKey, string consumerSecret, string token, string tokenSecret, string httpMethod, string timeStamp, string nonce, out string normalizedUrl, out string normalizedRequestParameters)
        {
            return GenerateSignature(url, consumerKey, consumerSecret, token, tokenSecret, httpMethod, timeStamp, nonce, SignatureTypes.HMACSHA1, out normalizedUrl, out normalizedRequestParameters);
        }

        /// <summary>
        /// Generates a signature using the specified signatureType
        /// </summary>
        /// <param name="url">The full url that needs to be signed including its non OAuth url parameters</param>
        /// <param name="consumerKey">The consumer key</param>
        /// <param name="consumerSecret">The consumer seceret</param>
        /// <param name="token">The token, if available. If not available pass null or an empty string</param>
        /// <param name="tokenSecret">The token secret, if available. If not available pass null or an empty string</param>
        /// <param name="httpMethod">The http method used. Must be a valid HTTP method verb (POST,GET,PUT, etc)</param>
        /// <param name="signatureType">The type of signature to use</param>
        /// <returns>A base64 string of the hash value</returns>
        public string GenerateSignature(Uri url, string consumerKey, string consumerSecret, string token, string tokenSecret, string httpMethod, string timeStamp, string nonce, SignatureTypes signatureType, out string normalizedUrl, out string normalizedRequestParameters)
        {
            normalizedUrl = null;
            normalizedRequestParameters = null;

            switch (signatureType)
            {
                case SignatureTypes.PLAINTEXT:
                    return HttpUtility.UrlEncode(string.Format("{0}&{1}", consumerSecret, tokenSecret));
                case SignatureTypes.HMACSHA1:
                    string signatureBase = GenerateSignatureBase(url, UrlEncode(consumerKey), token, tokenSecret, httpMethod, timeStamp, nonce, HMACSHA1SignatureType, out normalizedUrl, out normalizedRequestParameters);

                    HMACSHA1 hmacsha1 = new HMACSHA1();
                    hmacsha1.Key = Encoding.ASCII.GetBytes(string.Format("{0}&{1}", UrlEncode(consumerSecret), string.IsNullOrEmpty(tokenSecret) ? "" : UrlEncode(tokenSecret)));

                    return GenerateSignatureUsingHash(signatureBase, hmacsha1);
                case SignatureTypes.RSASHA1:
                    throw new NotImplementedException();
                default:
                    throw new ArgumentException("Unknown signature type", "signatureType");
            }
        }

        /// <summary>
        /// Generate the timestamp for the signature
        /// </summary>
        /// <returns></returns>
        public virtual string GenerateTimeStamp()
        {
            // Default implementation of UNIX time of the current UTC time
            TimeSpan ts = DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, 0);
            return Convert.ToInt64(ts.TotalSeconds).ToString();
        }

        /// <summary>
        /// Generate a nonce
        /// </summary>
        /// <returns></returns>
        public virtual string GenerateNonce()
        {
            // Just a simple implementation of a random number between 123400 and 9999999
            return random.Next(123400, 9999999).ToString();
        }

    }
}

Re: OAuth, getting it to work

killer10 — Mon, 26 Oct 2009 22:07:18 GMT

C#

Variables static:

    public string consumerKey = "http://www.myspace.com/XX"; // these u need to change
    public string consumerSecret = "XXX";
    public string requestServer = "http://api.myspace.com";
    public string requestServer2 = "http://www.urdomain.com";

Page_Load:

    string opensocial_viewer_id = Request.Params.Get("opensocial_viewer_id");
        string opensocial_owner_id = Request.Params.Get("opensocial_owner_id");
        string oauth_consumer_key = Request.Params.Get("oauth_consumer_key");
        string oauth_nonce = Request.Params.Get("oauth_nonce");
        string oauth_signature = Request.Params.Get("oauth_signature");
        string oauth_signature_method = Request.Params.Get("oauth_signature_method");
        string oauth_timestamp = Request.Params.Get("oauth_timestamp");
        string oauth_version = Request.Params.Get("oauth_version");
        string session_id = Request.Params.Get("session_id");
        string oauth_token = Request.Params.Get("oauth_token");
        string nocache = Request.Params.Get("nocache");

   Uri url = new Uri(requestServer2 + "/JSonService2.aspx?nocache=" + nocache + "&opensocial_owner_id=" + opensocial_owner_id + "&opensocial_viewer_id=" + opensocial_viewer_id);


             // Instantiate OAuthBase and declare variables
             OAuthBase oAuth = new OAuthBase();
             string nonce = oauth_nonce;
             string timeStamp = oauth_timestamp;
             string normUrl = string.Empty;
             string normParams = string.Empty;
             string strRequest = string.Empty;

             string signature = oAuth.GenerateSignature(url,
           consumerKey, consumerSecret, string.Empty, string.Empty,
           "GET", oauth_timestamp, oauth_nonce, OAuth.OAuthBase.SignatureTypes.HMACSHA1,
           out normUrl, out normParams);
             /*
this will be done in oAuth.GenerateSignature:
parameters.Add(new QueryParameter(OAuthVersionKey, OAuthVersion));
             parameters.Add(new QueryParameter(OAuthNonceKey, nonce));
             parameters.Add(new QueryParameter(OAuthTimestampKey, timeStamp));
             parameters.Add(new QueryParameter(OAuthSignatureMethodKey, signatureType));
             parameters.Add(new QueryParameter(OAuthConsumerKeyKey, consumerKey));
             */
             // Construct the OAuth authenticated REST url
             //   strRequest = normUrl + "?" + normParams + "&" + oAuth.UrlEncode("oauth_signature") + "=" + oAuth.UrlEncode(signature);

             sJSON += "signature:" + signature + "\n";
             sJSON += "oauth_signature:" + oauth_signature + "\n";

             sJSON += "opensocial_owner_id:" + opensocial_owner_id + "\n";
             sJSON += "oauth_consumer_key:" + oauth_consumer_key + "\n";
             sJSON += "oauth_nonce:" + oauth_nonce + "\n";

             sJSON += "oauth_signature_method:" + oauth_signature_method + "\n";
             sJSON += "oauth_timestamp:" + oauth_timestamp + "\n";
             sJSON += "oauth_version:" + oauth_version + "\n";
             sJSON += "oauth_token:" + oauth_token + "\n";
             if (signature == oauth_signature)
             {
                 sJSON = "SIGNED Request Secure";
             }
             else
             {
                 sJSON = "error no f";
             }

// Note sJSON is just my return buffer

Re: OAuth, getting it to work

Chris — Wed, 14 Oct 2009 21:10:37 GMT

Woud love to know which gem and what code proved to be the winning combination for you.

Thanks,

Chris

Re: OAuth, getting it to work

Pledge — Mon, 11 May 2009 08:40:03 GMT

I've been trying this technique for a few days now and verification keeps returning false, and I can't establish why. The request is on the same domain registered for the app, the key and secret are accurate. I can't think what else to try. Any ideas?

Re: OAuth, getting it to work

★★NIGGA NEVA BROKE SO U DONT GOTTA FIX ME★★G.E.D. — Thu, 11 Dec 2008 19:35:24 GMT

i dont have proble

Re: OAuth, getting it to work

Srikanth — Fri, 20 Jun 2008 05:58:16 GMT

Hi Giri,

Can you please share the ruby example. I tried to play with the Ruby Library and am running it lot of issues.

Appreciate your help

Re: OAuth, getting it to work

Benjamin — Fri, 23 May 2008 12:03:59 GMT

I haven't seen the action and controller being used when constructing the base string. Taking Guitarati's code sample above, after creating the signature object puts/log 'signature.signature_base_string' and compare this exactly against what you get in the oAuth tool. I've never seen the action/controller showing up in the base string and they definitely shouldn't.

Re: OAuth, getting it to work

Guitarati — Tue, 20 May 2008 22:13:18 GMT

Eric,

Using this code, I am being able to verify install/uninstall URLs that I filled in my app information. I think that whatever URL is pinged on install/uninstall is anyway resolved into an action and controller when it hits your server so we may not need to remove them from parameters_for_signature. If you could post/message the install/uninstall URLs you are using, I can check why the same code behaves differently for us.

Re: OAuth, getting it to work

Eric — Thu, 15 May 2008 23:31:13 GMT

Thanks for the posting Guitarati. I've tried with the exact code above but have not been able to get my signature to verify for the install/uninstall URLs that myspace uses. I'm also using the spacer gem and I am able to use the REST API which also depends on the oauth gem.

One thing I notice when debugging the oauth gem is that the action and controller are being used to construct the signature_base_string which is passed to the HMAC-SHA1 class. Myspace couldn't possibly have used that when it created the signature. I tried removing that as well in parameters_for_signature but still no dice.

Seems like this should be very simple- any words of advice?

Re: OAuth, getting it to work

Guitarati — Wed, 14 May 2008 21:53:01 GMT

Finally got this to work in Ruby using OAuth gem. Below is the code for a before_filter that can be used for Ruby on Rails actions requiring oauth.

CONSUMER_KEY = "xxxxxxxx"
CONSUMER_SECRET = "yyyyyyyy"

require 'oauth'
require 'oauth/consumer'
require 'oauth/request_proxy/action_controller_request'

def oauth_required
    consumer = OAuth::Consumer.new(CONSUMER_KEY, CONSUMER_SECRET)

    begin
      signature=OAuth::Signature.build(request) do
        # return the token secret and the consumer secret
        [nil, consumer.secret]
      end
      pass = signature.verify
      logger.info "Signature verification returned: #{pass}"
    rescue OAuth::Signature::UnknownSignatureMethod => e
      logger.error "ERROR"+ e.to_s
    end

    render :text => "OAuth access denied", :status => :unauthorized unless pass
end

Re: OAuth, getting it to work

Guitarati — Wed, 14 May 2008 16:32:24 GMT

Can someone please post the code to validate a Myspace request using the Ruby gem oauth?

I have installed the gem but I am not sure how to validate that a given GET / POST request is definitely coming from Myspace.

Am I right in thinking that we do not need the Ruby on Rails oauth plugin in addition to the gem just to validate that a request is coming from Myspace?

Thanks!

Re: OAuth, getting it to work

Fay — Tue, 01 Apr 2008 18:52:57 GMT

I compared the POST request with the OAuth tool, looks like I need to remove open_owner_id and open_viewer_id from the parameter list before generating the digital signature.

Re: OAuth, getting it to work

Drums — Wed, 26 Mar 2008 16:44:43 GMT

I found that php isn't registering the GET param that's empty at the beginning of the request that I saw coming in from myspace to my server from in my access logs. Myspace seem to be adding =& to the start of the query string and including it in the request signing. The following code snippet will properly set the empty query param and should then get the signing correct.

if(preg_match('/\?=&/', $_SERVER['REQUEST_URI']))
{
    $_GET[''] = '';
}

I also found that my mod_rewrite routing adds some params to the query string, so hense needed to unset those before doing the OAuth code.

Re: OAuth, getting it to work

Giri — Sun, 16 Mar 2008 14:02:14 GMT

Found the excellent OAuth ruby gem that has validation built in. Was doing manually following OAuth spec before but with the

gem it is just 3 lines of code! Ping me if you want the recipe.

Re: OAuth, getting it to work

► Ҝėvȋń ◄ ♂ — Sat, 15 Mar 2008 18:30:48 GMT

Smart:

Is it just me or is the OAuth token always empty?

According to the OAuth 1.0 spec, your supposed to be able to query the ServiceProvider for it...

Hi Smart,

It is empty, but you still need to include it (as an empty string) as part of the signature. I'd still suggest queying it from the request, just in case it changes in the future.

Cheers,
Kevin