Getting wrong signature in Flickr API on PHP

Question

I am facing some problem in generating oauth_signature for flickr api. Can you please look into this and advise me what I am doing wrong? // ps I am sharing my Flickr key and secret as I will change them when I will start production development.

Code

/* PHP code */
$NONCE=base64_decode(rand());    
$TIMESTAMP= gmdate('U');

$SECRET="39b4f5fd592ede81";    
$KEY="1bab082052d7cf8b3aa9e2bc92882ac0";

$CONSUMER_SECRET= $SECRET. "&";

$url_1 = "http://www.flickr.com/services/oauth/request_token?";    
$url_1 = urlencode($url_1);

$url_2 = "oauth_callback=http%3A%2F%2Flocalhost%2FFlickr%2Flogin.php&oauth_consumer_key=". $KEY;    
$url_2 .="&oauth_nonce=". $NONCE. "&oauth_signature_method=HMAC-SHA1&oauth_timestamp=". $TIMESTAMP. "&oauth_version=1.0";

// generate signature
$BASE_STRING ="";
$BASE_STRING .= "GET&". urlencode($url_1). urlencode($url_2);
$API_SIG= base64_encode(hash_hmac("sha1",$BASE_STRING,$CONSUMER_SECRET, true) );

// url generate
$url="http://www.flickr.com/services/oauth/request_token?oauth_callback=http://localhost/Flickr/login.php&oauth_consumer_key=". $KEY;
$url.="&oauth_nonce=". $NONCE. "&oauth_timestamp=". $TIMESTAMP. "&oauth_signature_method=HMAC-SHA1&oauth_version=1.0&oauth_signature=". $API_SIG;

// calling
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_REFERER, "http://www.example.org/yay.htm");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla Firefox/3.0");  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$data= curl_exec($ch);
echo $data;

curl_close($ch);

Answer 1

This worked for me, hopefully it helps someone else...

<?php

$consumerKey = 'your_Flickr_key';
$consumerSecret = 'your_Flickr_secret';

$requestTokenUrl = "https://www.flickr.com/services/oauth/request_token"; 
$oauthTimestamp = time();
$nonce = md5(mt_rand()); 
$oauthSignatureMethod = "HMAC-SHA1"; 
$oauthVersion = "1.0";


$sigBase = "GET&" . rawurlencode($requestTokenUrl) . "&"
    . rawurlencode("oauth_consumer_key=" . rawurlencode($consumerKey)
    . "&oauth_nonce=" . rawurlencode($nonce)
    . "&oauth_signature_method=" . rawurlencode($oauthSignatureMethod)
    . "&oauth_timestamp=" . $oauthTimestamp
    . "&oauth_version=" . $oauthVersion);


$sigKey = $consumerSecret . "&"; 
$oauthSig = base64_encode(hash_hmac("sha1", $sigBase, $sigKey, true));

$requestUrl = $requestTokenUrl . "?"
    . "oauth_consumer_key=" . rawurlencode($consumerKey)
    . "&oauth_nonce=" . rawurlencode($nonce)
    . "&oauth_signature_method=" . rawurlencode($oauthSignatureMethod)
    . "&oauth_timestamp=" . rawurlencode($oauthTimestamp)
    . "&oauth_version=" . rawurlencode($oauthVersion)
    . "&oauth_signature=" . rawurlencode($oauthSig); 

$response = file_get_contents($requestUrl);

var_export($response);

Answer 2

I am answering my own question. Thanks to Sam Judson: http://www.wackylabs.net

I removed base64_decode() from generating random numbers and it just did worked.