This is a guide on how to verify the signature of the canvas page. The canvas page has the option to allow developers to use an external iframe as their source for what to render in the iframe. This url is usually a url back to the 3rd party developer's website.

context:
my website: http://dev.sportsoverdose.com
my application: http://www.myspace.com/index.cfm?fuseaction=user.viewprofile&friendid=416179238
my application consumer key: http://www.myspace.com/416179238
my application settings: http://developer.myspace.com/modules/apps/pages/createappsource.aspx?appid=117185
my application Canvas Surface: (checked)Enabled - (selected)External IFrame - (External IFrame Url: )http://dev.sportsoverdose.com/myspace/verify/iframe.php


I created an iframe.php file with the code that does the signing and compares the signature. You can download it from the link below. You will also need the OAuth.php file

iframe.php file uses my consumer key and consumer secret and the same exact iframe url I entered in the canvas surface. In the code I split out the url and the querystring to pass to the signing process. oauth_signature from the querystring is removed during this process. After the signing I compare the results to that of the oauth_signature from the querystring


(rename the files to remove the .txt entension.)
http://dev.sportsoverdose.com/myspace/verify/iframe.php.txt
http://dev.sportsoverdose.com/myspace/verify/OAuth.php.txt

Sorry for the files being down. Server moved and I just updated the path to the new location. (Sept. 21, 2009)
http://www.viphaklay.com//myspace/verify/iframe.php.txt
http://www.viphaklay.com//myspace/verify/OAuth.php.txt

-V

works like a charm, thanks mate.

it's a pity that i lost so many time trying other solutons...

 The links to the php files are broken (looks like they are being run as php not printed).

I am doing the same procedure that you prescribed here but I am getting a no match. Any help please. What am I doing wrong?

 Here are the configuration parameters:

require_once("OAuth.php");

//NOTE: get these from the "Edit Details" of http://developer.myspace.com
//NOTE: http://developer.myspace.com/Apps.mvc
$consumer_key     = "http://www.myspace.com/505907434";
$consumer_secret  = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";

//NOTE: this is the same url you would enter in as the External IFrame in "Edit Source"
$server_uri       = "http://localhost/iframe.php";

//NOTE: this is the user of the canvas page
//http://profile.myspace.com/Modules/Applications/Pages/Canvas.aspx?appId=117185&newinstall=1

 

I have seen var_dumps and the signature are not matching