Oauth "invalid signature" error

nzsnapper

I am busy converting my Aperture plugin to use Oauth for authentication and to move to the lastest 1.3.0 API and seem to be having trouble with the signature. I must be doing something dumb but I can't see it :-(

An example base string used to create the signature is:

GET&http%3A%2F%2Fapi.smugmug.com%2Fservices%2Fapi%2Fjson%2F1.3.0&method%3Dsmugmug.albums.get%26oauth_consumer_key%3DWW1U80oIBzOLSOHUvoWgM5GzfU3qsfTX%26oauth_nonce%3DE37583D0-A8B8-4FB3-A7D3-6A3A90C6C292%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1316728948%26oauth_token%3D5dc7b0ca8bbfe9bc03e7b216c4694baf%26oauth_version%3D1.0

And the URL:

http://api.smugmug.com/services/api/json/1.3.0?method=smugmug.albums.get&oauth_consumer_key=WW1U80oIBzOLSOHUvoWgM5GzfU3qsfTX&oauth_nonce=E37583D0-A8B8-4FB3-A7D3-6A3A90C6C292&oauth_signature=lbMk2reS4gXEdjJ5nL%2B3YjJy%2BuM%3D&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1316728948&oauth_token=5dc7b0ca8bbfe9bc03e7b216c4694baf&oauth_version=1.0

The response I get:

{"stat":"fail","method":"smugmug.albums.get","code":35,"message":"invalid signature"}

I am using a 3rd party Oauth library and can successfully get the access token, any help would be appreciated.

Cheers
Richard

devbobo

Hey Richard,

The issue is that you should use http://api.smugmug.com/services/api/json/1.3.0/ as the base url instead of http://api.smugmug.com/services/api/json/1.3.0

If you load the url in the browser without the /, you will see that it redirects to the URL with the /, so when the signature validation fails since your signature base string doesn't have the additional %2F.

Hope this helps.

Cheers,

David

nzsnapper

Fixed

devbobo wrote: »

Hey Richard,

The issue is that you should use http://api.smugmug.com/services/api/json/1.3.0/ as the base url instead of http://api.smugmug.com/services/api/json/1.3.0

If you load the url in the browser without the /, you will see that it redirects to the URL with the /, so when the signature validation fails since your signature base string doesn't have the additional %2F.

Hope this helps.

Cheers,

David

Perfect, thanks David! Not sure I would have spotted that.