Another day banging my head against OAuth

Saturday, February 14, 2009 by Dave Winer.

I thought I had my signature-generating code right, I had it verified by two sources, but it still was being rejected by Twitter. I was looking for another service to test against, when Chris Messina posted a link to a wiki page that in turn pointed to three sites that verified signatures -- and I did a quick check, confident that my signature code would be validated, but it wasn't. They didn't agree. But, that implies that they don't agree with the first two sources I checked against. Which is really seriously troubling if I didn't make a mistake, which is why I'm going to very carefully check my work now. My notes follow, realtime. 

1. First result, I tested it with the Google page, and their signature and mine do not agree. I'm going to see if the "signature base strings" agree. They don't. Now to see where they differ and why. They don't differ -- I made a mistake in the test script. Once I corrected it, my signature-generating code and Google's return the same string. 

2. Tested against the Netflix page, and they agree as well. Of course had they not agreed then I suppose we'd all be fracked. (Speaking of which did you see BSG last night. I gotta watch that one again, for sure.) 

So.... 

My next plan of attack is to try some other call with Twitter, maybe I happened to hit on the one API they haven't debugged with OAuth yet. And try another OAuth-compatible app to test against. Something simple, one that a lot of people have developed against. Not sure there are any yet. I'll keep you posted.