在PHP的Flickr API中獲得錯誤的簽名

Question

我在為flickr api生成oauth_signature時遇到一些問題。 您能調查一下並告訴我我做錯了什么嗎？ // ps我正在共享我的Flickr密鑰和機密，因為在開始生產開發時將更改它們。

碼

/* PHP code */
$NONCE=base64_decode(rand());    
$TIMESTAMP= gmdate('U');

$SECRET="39b4f5fd592ede81";    
$KEY="1bab082052d7cf8b3aa9e2bc92882ac0";

$CONSUMER_SECRET= $SECRET. "&";

$url_1 = "http://www.flickr.com/services/oauth/request_token?";    
$url_1 = urlencode($url_1);

$url_2 = "oauth_callback=http%3A%2F%2Flocalhost%2FFlickr%2Flogin.php&oauth_consumer_key=". $KEY;    
$url_2 .="&oauth_nonce=". $NONCE. "&oauth_signature_method=HMAC-SHA1&oauth_timestamp=". $TIMESTAMP. "&oauth_version=1.0";

// generate signature
$BASE_STRING ="";
$BASE_STRING .= "GET&". urlencode($url_1). urlencode($url_2);
$API_SIG= base64_encode(hash_hmac("sha1",$BASE_STRING,$CONSUMER_SECRET, true) );

// url generate
$url="http://www.flickr.com/services/oauth/request_token?oauth_callback=http://localhost/Flickr/login.php&oauth_consumer_key=". $KEY;
$url.="&oauth_nonce=". $NONCE. "&oauth_timestamp=". $TIMESTAMP. "&oauth_signature_method=HMAC-SHA1&oauth_version=1.0&oauth_signature=". $API_SIG;

// calling
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_REFERER, "http://www.example.org/yay.htm");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla Firefox/3.0");  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$data= curl_exec($ch);
echo $data;

curl_close($ch);

Answer 1

這對我有用，希望對其他人有幫助...

<?php

$consumerKey = 'your_Flickr_key';
$consumerSecret = 'your_Flickr_secret';

$requestTokenUrl = "https://www.flickr.com/services/oauth/request_token"; 
$oauthTimestamp = time();
$nonce = md5(mt_rand()); 
$oauthSignatureMethod = "HMAC-SHA1"; 
$oauthVersion = "1.0";


$sigBase = "GET&" . rawurlencode($requestTokenUrl) . "&"
    . rawurlencode("oauth_consumer_key=" . rawurlencode($consumerKey)
    . "&oauth_nonce=" . rawurlencode($nonce)
    . "&oauth_signature_method=" . rawurlencode($oauthSignatureMethod)
    . "&oauth_timestamp=" . $oauthTimestamp
    . "&oauth_version=" . $oauthVersion);


$sigKey = $consumerSecret . "&"; 
$oauthSig = base64_encode(hash_hmac("sha1", $sigBase, $sigKey, true));

$requestUrl = $requestTokenUrl . "?"
    . "oauth_consumer_key=" . rawurlencode($consumerKey)
    . "&oauth_nonce=" . rawurlencode($nonce)
    . "&oauth_signature_method=" . rawurlencode($oauthSignatureMethod)
    . "&oauth_timestamp=" . rawurlencode($oauthTimestamp)
    . "&oauth_version=" . rawurlencode($oauthVersion)
    . "&oauth_signature=" . rawurlencode($oauthSig); 

$response = file_get_contents($requestUrl);

var_export($response);

Answer 2

我在回答我自己的問題。 感謝Sam Judson： http : //www.wackylabs.net

我從生成隨機數中刪除了base64_decode() ，它確實起作用了。