oauth-1.0a

What is oauth-1.0a?

The oauth-1.0a npm package is a lightweight library for implementing OAuth 1.0a authentication in Node.js applications. It provides utilities for generating OAuth signatures, creating authorization headers, and handling the OAuth flow.

What are oauth-1.0a's main functionalities?

Generate OAuth Signature

This feature allows you to generate an OAuth signature for a given request. The code sample demonstrates how to create an OAuth instance, define the request data, and generate the signature using the consumer and token credentials.

const OAuth = require('oauth-1.0a');
const crypto = require('crypto');

const oauth = OAuth({
  consumer: { key: 'your-consumer-key', secret: 'your-consumer-secret' },
  signature_method: 'HMAC-SHA1',
  hash_function(base_string, key) {
    return crypto.createHmac('sha1', key).update(base_string).digest('base64');
  }
});

const request_data = {
  url: 'https://api.example.com/resource',
  method: 'GET'
};

const token = {
  key: 'your-access-token',
  secret: 'your-token-secret'
};

const signature = oauth.authorize(request_data, token);
console.log(signature);

Create Authorization Header

This feature allows you to create an OAuth authorization header for a given request. The code sample demonstrates how to generate the authorization header using the OAuth instance and the request data.

const OAuth = require('oauth-1.0a');
const crypto = require('crypto');

const oauth = OAuth({
  consumer: { key: 'your-consumer-key', secret: 'your-consumer-secret' },
  signature_method: 'HMAC-SHA1',
  hash_function(base_string, key) {
    return crypto.createHmac('sha1', key).update(base_string).digest('base64');
  }
});

const request_data = {
  url: 'https://api.example.com/resource',
  method: 'GET'
};

const token = {
  key: 'your-access-token',
  secret: 'your-token-secret'
};

const authorizationHeader = oauth.toHeader(oauth.authorize(request_data, token));
console.log(authorizationHeader);

Handle OAuth Flow

This feature demonstrates how to handle the OAuth flow to access a protected resource. The code sample shows how to generate the authorization header and make an authenticated request using the axios library.

const OAuth = require('oauth-1.0a');
const crypto = require('crypto');
const axios = require('axios');

const oauth = OAuth({
  consumer: { key: 'your-consumer-key', secret: 'your-consumer-secret' },
  signature_method: 'HMAC-SHA1',
  hash_function(base_string, key) {
    return crypto.createHmac('sha1', key).update(base_string).digest('base64');
  }
});

async function getProtectedResource() {
  const request_data = {
    url: 'https://api.example.com/resource',
    method: 'GET'
  };

  const token = {
    key: 'your-access-token',
    secret: 'your-token-secret'
  };

  const authorizationHeader = oauth.toHeader(oauth.authorize(request_data, token));

  try {
    const response = await axios.get(request_data.url, { headers: authorizationHeader });
    console.log(response.data);
  } catch (error) {
    console.error(error);
  }
}

getProtectedResource();

Other packages similar to oauth-1.0a

oauth

The 'oauth' package is a comprehensive library for OAuth 1.0 and OAuth 2.0 authentication. It provides a higher-level abstraction compared to oauth-1.0a and supports both OAuth versions, making it more versatile for different authentication needs.

simple-oauth2

The 'simple-oauth2' package is designed for OAuth 2.0 authentication and provides a simple and easy-to-use API for obtaining access tokens and making authenticated requests. It does not support OAuth 1.0a, so it is not a direct replacement for oauth-1.0a but is useful for OAuth 2.0 scenarios.

passport-oauth1

The 'passport-oauth1' package is a Passport strategy for OAuth 1.0a authentication. It integrates with the Passport.js authentication middleware, making it a good choice for applications that use Passport for managing authentication strategies.

README

oauth-1.0a

OAuth 1.0a Request Authorization for Node and Browser

Send OAuth request with your favorite HTTP client (request, jQuery.ajax...)

No more headache about OAuth 1.0a's stuff or "oauth_consumer_key, oauth_nonce, oauth_signature...." parameters, just use your familiar HTTP client to send OAuth requests.

Tested on some popular OAuth 1.0a services:

• Twitter
• Flickr
• Bitbucket
• Linkedin

Quick Start

var oauth = OAuth({
    consumer: {
        public: '<your consumer key>',
        secret: '<your consumer secret>'
    }
});

Get OAuth request data then you can use with your http client easily :)

oauth.authorize(request, token);

Or if you want to get as a header key-value data

oauth.toHeader(oauth_data);

##Installation

###Node.js $ npm install oauth-1.0a

###Browser Download oauth-1.0a.js here

<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-sha1.js"></script>
<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/enc-base64-min.js"></script>
<script src="oauth-1.0a.js"></script>

##Examples

###Work with request (Node.js)

Depencies

var request = require('request');
var OAuth   = require('oauth-1.0a');

Init

var oauth = OAuth({
    consumer: {
        public: 'xvz1evFS4wEEPTGEFPHBog',
        secret: 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw'
    },
    signature_method: 'HMAC-SHA1'
});

Your request data

var request_data = {
	url: 'https://api.twitter.com/1/statuses/update.json?include_entities=true',
    method: 'POST',
    data: {
        status: 'Hello Ladies + Gentlemen, a signed OAuth request!'
    }
};

Your token (optional for some requests)

var token = {
    public: '370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb',
    secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE'
};

Call a request

request({
	url: request_data.url,
	method: request_data.method,
	form: oauth.authorize(request_data, token)
}, function(error, response, body) {
	//process your data here
});

Or if you want to send OAuth data in request's header

request({
	url: request_data.url,
	method: request_data.method,
	form: request_data.data,
	headers: oauth.toHeader(oauth.authorize(request_data, token))
}, function(error, response, body) {
	//process your data here
});

###Work with jQuery.ajax (Browser)

Caution: please make sure you understand what happen when use OAuth protocol at client side here

Init

var oauth = OAuth({
    consumer: {
        public: 'xvz1evFS4wEEPTGEFPHBog',
        secret: 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw'
    },
    signature_method: 'HMAC-SHA1'
});

Your request data

var request_data = {
	url: 'https://api.twitter.com/1/statuses/update.json?include_entities=true',
    method: 'POST',
    data: {
        status: 'Hello Ladies + Gentlemen, a signed OAuth request!'
    }
};

Your token (optional for some requests)

var token = {
    public: '370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb',
    secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE'
};

Call a request

$.ajax({
	url: request_data.url,
	type: request_data.method,
	data: oauth.authorize(request_data, token)
}).done(function(data) {
	//process your data here
});

Or if you want to send OAuth data in request's header

$.ajax({
	url: request_data.url,
	type: request_data.method,
	data: request_data.data,
	headers: oauth.toHeader(oauth.authorize(request_data, token))
}).done(function(data) {
	//process your data here
});

##Options

var oauth = OAuth(/* options */);

• consumer: Object Required your consumer keys

{
    public: <your consumer key>,
    secret: <your consumer secret>
}

• signature_method: String default 'HMAC-SHA1'
• nonce_length: Int default 32
• version: String default '1.0'
• parameter_seperator: String for header only, default ', '. Note that there is a space after ,
• last_ampersand: Bool default true. For some services if there is no Token Secret then no need & at the end. Check oauth doc for more information

oauth_signature is set to the concatenated encoded values of the Consumer Secret and Token Secret, separated by a '&' character (ASCII code 38), even if either secret is empty

##Notes

• Some OAuth requests without token use .authorize(request_data) instead of .authorize(request_data, {})

• Or just token public only .authorize(request_data, {public: 'xxxxx'})

• Want easier? Take a look:

  • Node.js: oauth-request
  • jquery: soon

##Client Side Usage Caution

OAuth is based around allowing tools and websites to talk to each other. However, JavaScript running in web browsers is hampered by security restrictions that prevent code running on one website from accessing data stored or served on another.

Before you start hacking, make sure you understand the limitations posed by cross-domain XMLHttpRequest.

On the bright side, some platforms use JavaScript as their language, but enable the programmer to access other web sites. Examples include:

• Google/Firefox/Safari extensions
• Google Gadgets
• Microsoft Sidebar...

For those platforms, this library should come in handy.

##Todo please check my todo list

##Changelog

##Depencies

• Browser: crypto-js
• Node: crypto-js