Product
Introducing License Enforcement in Socket
Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
oauth-signature
Advanced tools
npm
:npm install oauth-signature
bower
:bower install oauth-signature
Add a <script>
to your index.html
:
<script src="/bower_components/oauth-signature/dist/oauth-signature.js"></script>
To generate the OAuth signature call the following method:
oauthSignature.generate(httpMethod, url, parameters, consumerSecret, tokenSecret, options)
tokenSecret
is optionaloptions
is optionalthe default options
parameter is as follows
var options = {
encodeSignature: true // will encode the signature following the RFC 3986 Spec by default
}
The following is an example on how to generate the signature for the reference sample as defined in
var httpMethod = 'GET',
url = 'http://photos.example.net/photos',
parameters = {
oauth_consumer_key : 'dpf43f3p2l4k3l03',
oauth_token : 'nnch734d00sl2jdk',
oauth_nonce : 'kllo9940pd9333jh',
oauth_timestamp : '1191242096',
oauth_signature_method : 'HMAC-SHA1',
oauth_version : '1.0',
file : 'vacation.jpg',
size : 'original'
},
consumerSecret = 'kd94hf93k423kf44',
tokenSecret = 'pfkkdhi9sl3r4s00',
// generates a RFC 3986 encoded, BASE64 encoded HMAC-SHA1 hash
encodedSignature = oauthSignature.generate(httpMethod, url, parameters, consumerSecret, tokenSecret),
// generates a BASE64 encode HMAC-SHA1 hash
signature = oauthSignature.generate(httpMethod, url, parameters, consumerSecret, tokenSecret,
{ encodeSignature: false});
The encodedSignature
variable will contain the RFC 3986 encoded, BASE64 encoded HMAC-SHA1 hash, ready to be used as a query parameter in a request: tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D
.
The signature
variable will contain the BASE64 HMAC-SHA1 hash, without encoding: tR3+Ty81lMeYAr/Fid0kMTYa/WM=
.
Use the generated signature to populate the oauth_signature
parameter to sign a protected resource as per RFC.
Example GET request using query string parameters:
This project has an extensive test coverage for all the corner cases present in the OAuth specifications (RFC 5843 + Errata ID 2550 and OAuth.net community-based specification)
Take a look at the test file src/app/signature.tests.js
The tests can be executed in your browser or in node
Open the file src/test-runner.html in your browser
You can also run them live: src/test-runner.html
Execute npm test
in the console
If you want to make a working experiment you can use the live version of the OAuth signature page at this url: http://bettiolo.github.io/oauth-reference-page/
And you can hit the echo OAuth endpoints at this url: http://echo.lab.madgex.com/
foo
and value bar
A url similar to this one will be generated: http://echo.lab.madgex.com/echo.ashx?foo=bar&oauth_consumer_key=key&oauth_nonce=643377115&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1410807318&oauth_token=accesskey&oauth_version=1.0&oauth_signature=zCmKoF9rVlNxAkD8wUCizFUajs4%3D
Click on the generated link on the right hand side and you will see the echo server returning foo=bar
npm run update
Update them via npm
but also manually in test-runner.html
npm version [major|minor|patch]
git push
git push --tags
FAQs
OAuth 1.0a signature generator (RFC 5849)
The npm package oauth-signature receives a total of 11,093 weekly downloads. As such, oauth-signature popularity was classified as popular.
We found that oauth-signature demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
Product
We're launching a new set of license analysis and compliance features for analyzing, managing, and complying with licenses across a range of supported languages and ecosystems.
Product
We're excited to introduce Socket Optimize, a powerful CLI command to secure open source dependencies with tested, optimized package overrides.