的Twitter的Oauth失敗，原因是簽名和令牌

Question

我想箱子一個應用程序從Twitter進行身份驗證，但我得到以下錯誤 ：

Failed to validate oauth signature and token 

這裏是我的應用程序代碼：

public class TwitCons { 

    String sign_method ="HMAC-SHA1"; 

    public static String consumer_key ="^^^^^^^^^^^^^^^^^^^^"; 
    public static String consumer_secret="^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"; 
    String request_uri = "https://api.twitter.com/oauth/request_token"; 
    String oauth_callback="http://127.0.0.1:8080/twitter/getToken"; 

    String getNonce(){ 
     Random ran = new Random(); 
     long nonce1 = ran.nextLong(); 

     Long nonce = Math.abs(new Long(nonce1)); 

     return nonce.toString(); 
    } 


    String getTimestamp(){ 
     long time = System.currentTimeMillis(); 


     return String.valueOf(time/1000); 
    } 


    String getSignature(String request_uri ,String request_token,String nonce) throws UnsupportedEncodingException 
    { 
     String base="oauth_callback=http://127.0.0.1:8080/twitter/getToken&oauth_consumer_key="+consumer_key+"&oauth_nonce="+nonce+"&oauth_signature_method="+sign_method+"&oauth_timestamp="+getTimestamp()+"&oauth_token=&oauth_version=1.0"; 

     String baseString="POST&"+URLEncoder.encode(request_uri , "UTF-8")+"&"+URLEncoder.encode(base , "UTF-8"); 

     String signKey = consumer_secret +"&"+ request_token ; 
     System.out.println(signKey +"\n"+baseString); 

     try { 
      SecretKeySpec signingKey = new SecretKeySpec(signKey.getBytes(),"HmacSHA1"); 
      Mac mac = Mac.getInstance(signingKey.getAlgorithm()); 
      mac.init(signingKey); 
      byte[] rawHmac = mac.doFinal(baseString.getBytes()); 
      String result = new String(Base64.encodeBase64(rawHmac)); 
      System.out.println(URLEncoder.encode(result , "UTF-8")); 
      return URLEncoder.encode(result , "UTF-8"); 
      //return result; 

     } catch (GeneralSecurityException e) { 
      return ""; 
     } 




    } 


} 

和

public class Twitter extends TwitCons{ 

    public void getRequest() throws IllegalArgumentException, HttpException, IOException 
    { 

     HttpClient client = new HttpClient(); 
     PostMethod post = new PostMethod("https://api.twitter.com/oauth/request_token"); 
     String nonce=getNonce(); 
     String header = "oauth_callback=\""+URLEncoder.encode(oauth_callback ,"UTF-8")+"\","+ 
      "oauth_consumer_key=\""+consumer_key +"\","+ 
      "oauth_nonce=\""+nonce + "\","+ 
      "oauth_signature=\""+getSignature(request_uri,"",nonce) + "\","+ 
      "oauth_signature_method=\""+sign_method + "\","+ 
      "oauth_timestamp=\""+getTimestamp() + "\","+ 
      "oauth_version=\"1.0\"" ; 

     post.addRequestHeader("Authorization", "OAuth "+header); 
     client.executeMethod(post); 

     System.out.println(post.getResponseBodyAsString()+"\n"+post.getRequestHeader("Authorization")); 






    } 

類有方法getRequest用於使twitte在r要求越來越request_token和token_secret

和第二類TwitCons有不同的方法和常量來獲得請求令牌

Answer 1

你缺少 oauth_token在 String base。見 https://dev.twitter.com/docs/auth/3-legged-authorization如何獲得一個（如果你還不知道這一點，並沒有忘記把它放在你的基本字符串;））。

可能是因爲您的base字符串中包含&oauth_token=而導致您的簽名計算錯誤，但該密鑰不屬於您的請求的一部分。 OAuth 1.0 specification只是說：

簽名基本字符串是請求元素一致的可重複串聯到單個字符串中。

可能值得嘗試去除那部分字符串。

UPDATE：

你可能有來urlencode在Authorization頭回調URL，有字母排序，並把參數引號爲@空氣-DEX建議。試試這個：

String oauth_callback = "http://127.0.0.1:8080/twitter/getToken"; 
String oauth_callback_encoded = URLEncoder.encode(oauth_callback, "UTF-8"); 

然後

String header = "oauth_callback=\"" + oauth_callback_encoded + "\", " + 
      "oauth_consumer_key=\"" + consumer_key + "\", " + 
      "oauth_nonce=\"" + nonce + "\", " + 
      "oauth_signature=\"" + getSignature(request_uri, "", nonce) + "\", " + 
      "oauth_signature_method=\"" + sign_method + "\", " + 
      "oauth_timestamp=\"" + getTimestamp() + "\", " + 
      "oauth_version=\"1.0\""; 

和

String base = "oauth_consumer_key=" + consumer_key + 
      "&oauth_nonce=" + nonce + 
      "&oauth_signature_method=" + sign_method + 
      "&oauth_timestamp=" + getTimestamp() + 
      "&oauth_version=1.0"; 

Answer 2

在Twitter.getRequest()，似乎你的頭看起來是錯誤的。各參數的值必須由雙引號，包圍（"）：https://dev.twitter.com/docs/auth/authorizing-request

EDIT：

StringBuilder headerBuilder = new StringBuilder("OAuth "); 

headerBuilder.append("oauth_callback=\"").append(oauth_callback).append("\", "); 
headerBuilder.append("oauth_consumer_key=\"").append(consumer_key).append("\", "); 
headerBuilder.append("oauth_nonce=\"").append(nonce).append("\", "); 
headerBuilder.append("oauth_signature=\"").append(getSignature(request_uri,"",nonce)).append("\", "); 
headerBuilder.append("oauth_signature_method=\"").append(sign_method).append("\", "); 
headerBuilder.append("oauth_timestamp=\"").append(getTimestamp()).append("\", "); 
headerBuilder.append("oauth_version=\"1.0\""); 

String header = headerBuilder.toString(); 

更多細節請參見Twitter API中的相應的頁面代碼固定，因爲沒有逗號前的空格。