Security News
Introducing the Socket Python SDK
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
oauth-signature
Advanced tools
npm
:npm install oauth-signature
bower
:bower install oauth-signature
Add a <script>
to your index.html
:
<script src="/bower_components/oauth-signature/dist/oauth-signature.js"></script>
To generate the OAuth signature call the following method:
oauthSignature.generate(httpMethod, url, parameters, consumerSecret, tokenSecret, options)
tokenSecret
is optionaloptions
is optionalthe default options
parameter is as follows
var options = {
encodeSignature: true // will encode the signature following the RFC 3986 Spec by default
}
The following is an example on how to generate the signature for the reference sample as defined in
var httpMethod = 'GET',
url = 'http://photos.example.net/photos',
parameters = {
oauth_consumer_key : 'dpf43f3p2l4k3l03',
oauth_token : 'nnch734d00sl2jdk',
oauth_nonce : 'kllo9940pd9333jh',
oauth_timestamp : '1191242096',
oauth_signature_method : 'HMAC-SHA1',
oauth_version : '1.0',
file : 'vacation.jpg',
size : 'original'
},
consumerSecret = 'kd94hf93k423kf44',
tokenSecret = 'pfkkdhi9sl3r4s00',
// generates a RFC 3986 encoded, BASE64 encoded HMAC-SHA1 hash
encodedSignature = oauthSignature.generate(httpMethod, url, parameters, consumerSecret, tokenSecret),
// generates a BASE64 encode HMAC-SHA1 hash
signature = oauthSignature.generate(httpMethod, url, parameters, consumerSecret, tokenSecret,
{ encodeSignature: false});
The encodedSignature
variable will contain the RFC 3986 encoded, BASE64 encoded HMAC-SHA1 hash, ready to be used as a query parameter in a request: tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D
.
The signature
variable will contain the BASE64 HMAC-SHA1 hash, without encoding: tR3+Ty81lMeYAr/Fid0kMTYa/WM=
.
Use the generated signature to populate the oauth_signature
parameter to sign a protected resource as per RFC.
Example GET request using query string parameters:
This project has an extensive test coverage for all the corner cases present in the OAuth specifications (RFC 5843 + Errata ID 2550 and OAuth.net community version)
Take a look at the test file src/app/signature.tests.js
The tests can be executed in your browser or in node
Open the file src/test-runner.html in your browser
You can also run them live: src/test-runner.html
Execute npm test
in the console
If you want to make a working experiment you can use the live version of the OAuth signature page at this url: http://bettiolo.github.io/oauth-reference-page/
And you can hit the echo OAuth endpoints at this url: http://echo.lab.madgex.com/
foo
and value bar
A url similar to this one will be generated: http://echo.lab.madgex.com/echo.ashx?foo=bar&oauth_consumer_key=key&oauth_nonce=643377115&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1410807318&oauth_token=accesskey&oauth_version=1.0&oauth_signature=zCmKoF9rVlNxAkD8wUCizFUajs4%3D
Click on the generated link on the right hand side and you will see the echo server returning foo=bar
FAQs
OAuth 1.0a signature generator (RFC 5849)
The npm package oauth-signature receives a total of 15,116 weekly downloads. As such, oauth-signature popularity was classified as popular.
We found that oauth-signature demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
Security News
Floating dependency ranges in npm can introduce instability and security risks into your project by allowing unverified or incompatible versions to be installed automatically, leading to unpredictable behavior and potential conflicts.
Security News
A new Rust RFC proposes "Trusted Publishing" for Crates.io, introducing short-lived access tokens via OIDC to improve security and reduce risks associated with long-lived API tokens.