twitter oauth请求令牌失败

Question

i tried to implement "Sign in with Twitter"
i see lots of questions at this topic here, i've read lots of them and stuck at all
i used folowing links :

implementing Sign in with Twitter
POST oauth/request_token
Creating a signature
Authorizing a request

and the result is
response : Failed to validate oauth signature and token (may be it's most often error =))

what i've done:

date_default_timezone_set('UTC');
$oauth_consumer_key = 'mYOauThConsuMerKey'; //from app settings

function generate_nonce() {
    $mt = microtime();
    $rand = mt_rand();
    return md5($mt . $rand); // md5s look nicer than numbers
}
$oauth_nonce = generate_nonce();
    $http_method = 'POST';
    $base_url = 'https://api.twitter.com/oauth/request_token';
    $oauth_signature_method = 'HMAC-SHA1';
    $oauth_timestamp = time();
    $oauth_token = 'mytokenFromAPPsettoings';
    $oauth_version = '1.0';
$oauth_callback = 'http://twoends.home/backend';
    $params = array(
        rawurlencode('oauth_nonce')=>rawurlencode($oauth_nonce),
        rawurlencode('oauth_callback')=>rawurlencode($oauth_callback),
        rawurlencode('oauth_signature_method')=>rawurlencode($oauth_signature_method),
        rawurlencode('oauth_timestamp')=>rawurlencode($oauth_timestamp),
        rawurlencode('oauth_token')=>rawurlencode($oauth_token),
        rawurlencode('oauth_version')=>rawurlencode($oauth_version),
    );

    ksort($params);
    $parameter_string = http_build_query($params,'','&');
        $base_string  = strtoupper($http_method).'&';
        $base_string .= rawurlencode($base_url).'&';
        $base_string .= rawurlencode($parameter_string);

        $oauth_consumer_secret = 'myappconsumersecret';
        $oauth_token_secret = 'mytokensecret';
$oauth_signing_key =rawurlencode($oauth_consumer_secret).'&'.rawurlencode($oauth_token_secret);
$oauth_signature = base64_encode(hash_hmac('sha1', $base_string, $oauth_signing_key, true));
$DST ='OAuth ';
foreach($params as $key=>$value){
    $DST .= $key.'='.'"'.$value.'"&';
}
$DST = rtrim($DST,'&');

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $base_url);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: '.$DST));
curl_setopt($ch, CURLINFO_HEADER_OUT, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
$info = curl_getinfo($ch);
curl_close($ch);

so,this code was struggled much and it still produces error
in one topic i've read that token isn't needed on this stage : with it or without - nothing matters - still same error
tried to play with time (set UTC) - same error
also i tried to use someones working code like this but that didn't work for me
why i'm not using someones lib - because i want to go through algo step-by-step, but i'm tired with it and neeed help

thx in advance, any help appreciated, may be got an example of working step-by-step guide ?

Answer 1

There appear to be several things wrong with your code:

1) Your params array should contain oauth_consumer_key instead of oauth_token

$params = array(
    rawurlencode('oauth_nonce')=>rawurlencode($oauth_nonce),
    rawurlencode('oauth_callback')=>rawurlencode($oauth_callback),
    rawurlencode('oauth_signature_method')=>rawurlencode($oauth_signature_method),
    rawurlencode('oauth_timestamp')=>rawurlencode($oauth_timestamp),
    rawurlencode('oauth_consumer_key')=>rawurlencode($oauth_consumer_key),
    rawurlencode('oauth_version')=>rawurlencode($oauth_version),
);

2) Your signing key for a request token should be constructed using oauth_consumer_secret followed by an ampersand:

$oauth_signing_key =rawurlencode($oauth_consumer_secret).'&';

3) You don't appear to be setting the signature anywhere in the Authorization header. Do:

$DST ='OAuth ';
foreach($params as $key=>$value){
    $DST .= $key.'='.'"'.$value.'"&';
}
$DST .= 'oauth_signature='.rawurlencode($oauth_signature)

Answer 2

i'd like to take a new look at a problem and post new data
thanks to @Jonny S i found few mistakes and got another error =)

so, my workflow now looks:

function to generate nonce,additional info: oauth_nonce in api , oauth.net

function generate_nonce() {
    $mt = microtime();
    $rand = mt_rand();

    return md5($mt . $rand); // md5s look nicer than numbers
}

Implementing Sign in with Twitter (this link shows us what header we should POST in advance) and shows us direction to move - POST oauth/request_token
this page links with oauth docs section 6.1
there we can find what parameters are needed to request token, but in official docs you would not find "oauth_calback" param which is a required param in twitter API!

the next step i do - collecting needed params:

• oauth_consumer_key
  

   $oauth_consumer_key = 'YoUrS KEy FrOm aPP ApI'; 

• oauth_nonce

   $oauth_nonce = generate_nonce(); 

• oauth_callback

   $oauth_callback = 'http://twoends.home/backend'; 

• oauth_sinature_method

   $oauth_signature_method = 'HMAC-SHA1'; 

• oauth_timestamp

   $oauth_timestamp = time(); 

• oauth_version

   $oauth_version = '1.0'; 

• additional parameters (needed in process):

  • Base URL

    $base_url = ' https://api.twitter.com/oauth/request_token ';

  • HTTP Method

    $http_method = 'POST';

• OAuth Signature (the most tricky part)

here we have an API page on how to do it Creating a signature

first we need to collect all needed params together,percent encode and sort them, i pushed them to array:

    $params = array(
        rawurlencode('oauth_consumer_key')=>rawurlencode($oauth_consumer_key),
        rawurlencode('oauth_nonce')=>rawurlencode($oauth_nonce),
        rawurlencode('oauth_callback')=>rawurlencode($oauth_callback),
        rawurlencode('oauth_signature_method')=>rawurlencode($oauth_signature_method),
        rawurlencode('oauth_timestamp')=>rawurlencode($oauth_timestamp),
        rawurlencode('oauth_version')=>rawurlencode($oauth_version),
    );

and then sort:

    ksort($params);

then i'm creating parameter string:

    $parameter_string = http_build_query($params,'','&');

result:

param string :oauth_callback=http%253A%252F%252Ftwoends.home%252Fbackend&oauth_consumer_key=oauth_consumer_key_wQjQ7u5lgwA&oauth_nonce=46fa649c21ac5315d4d4510ff68ad630&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1381930918&oauth_version=1.0

next i need to create base_string, which will be used to create signature as data param for hash_hmac() function

    $base_string = strtoupper($http_method).'&';
    $base_string .= rawurlencode($base_url).'&';
    $base_string .= rawurlencode($parameter_string);

result:

POST&https%3A%2F%2Fapi.twitter.com%2Foauth%2Frequest_token&oauth_callback%3Dhttp%25253A%25252F%25252Ftwoends.home%25252Fbackend%26oauth_consumer_key%3Dapp_cons_keyQjQ7u5lgwA%26oauth_nonce%3D46fa649c21ac5315d4d4510ff68ad630%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1381930918%26oauth_version%3D1.0

next i get consumer_secret from APP settings to create signing key which will be used to create signature as a third param at hash_hmac() function

    $oauth_consumer_secret = 'consumer_secret_from_app_settings';
    $oauth_signing_key = rawurlencode($oauth_consumer_secret).'&';

one thing to mention: in 1st step (request_token we don't need to put any token)

this step creates signature:

    $oauth_signature = base64_encode(hash_hmac('sha1', $base_string, $oauth_signing_key, true));

now we need to add signature to params array and build header string

    $params['oauth_signature'] = rawurlencode($oauth_signature);
    ksort($params);

building header string can be found at Building the header string

    $DST ='OAuth ';
    foreach($params as $key=>$value){
        $DST .= $key.'='.'"'.$value.'", ';
    }
    $DST = rtrim($DST,', ');

    //or we can make it by hand as below

    //$DST .= 'oauth_nonce="'.rawurlencode($oauth_nonce)
    //     .'", oauth_callback="'.rawurlencode($oauth_callback)
    //     .'", oauth_signature_method="HMAC-SHA1", oauth_timestamp="'
    //     .rawurlencode($oauth_timestamp).'", oauth_consumer_key="'
    //     .rawurlencode($oauth_consumer_key).'", oauth_signature="'
    //     .rawurlencode($oauth_signature).'", oauth_version="1.0"';

the final step (i hope) is to send a request:

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $base_url);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: '.$DST));
    curl_setopt($ch, CURLINFO_HEADER_OUT, 1);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

    $response = curl_exec($ch);
    $info = curl_getinfo($ch);
    curl_close($ch);

    echo '<pre>';
        print_r($info);
    echo '</pre>';

this code produces error 400 - bad request
if i remove curl_setopt($ch, CURLOPT_POST, true); i get error - 401
request info dump :

Array
(
    [url] => https://api.twitter.com/oauth/request_token
    [content_type] => 
    [http_code] => 400
    [header_size] => 66
    [request_size] => 471
    [filetime] => -1
    [ssl_verify_result] => 0
    [redirect_count] => 0
    [total_time] => 0.710993
    [namelookup_time] => 0.081279
    [connect_time] => 0.23482
    [pretransfer_time] => 0.550913
    [size_upload] => 0
    [size_download] => 0
    [speed_download] => 0
    [speed_upload] => 0
    [download_content_length] => 0
    [upload_content_length] => -1
    [starttransfer_time] => 0.710976
    [redirect_time] => 0
    [redirect_url] => 
    [primary_ip] => 199.16.156.104
    [certinfo] => Array
    (
    )

    [primary_port] => 443
    [local_ip] => 192.168.1.234
    [local_port] => 54994
    [request_header] => POST /oauth/request_token HTTP/1.1
Host: api.twitter.com
Accept: */*
Authorization: OAuth oauth_callback="http%3A%2F%2Ftwoends.home%2Fbackend", oauth_consumer_key="your_consumer_keyCwQjQ7u5lgwA", oauth_nonce="1ba83f0af239f439c1524096c33faefe", oauth_signature="QZZvrJ8wzCQOYhiKJeT4vz%2FWCcg%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1381931941", oauth_version="1.0"
Content-Length: -1
Content-Type: application/x-www-form-urlencoded
Expect: 100-continue


)

hope this will help to understand where to find the error, in advance i'll also try to use Fiddler to trace request

---------------------------------------
solved by using new API

Answer 3

It looks like the oauth_callback url is being triple encoded in the basestring. It should be of the form:

POST&https%3A%2F%2Fapi.twitter.com%2Foauth%2Frequest_token&
oauth_callback%3Dhttp%253A%252F%252Ftwoends.home%252Fbackend%26
oauth_consumer_key%3Dapp_cons_keyQjQ7u5lgwA ...

In your basestring:

oauth_callback%3Dhttp%25253A%25252F%25252Ftwoends.home%25252Fbackend

The culprit appears to be 'http_build_query'.