jrconlin/oauthsimple — Issue #13: Not normalizing URIs before building the base string for signing?
Author: doooks
Created: 2011-12-07 14:47:57+00:00
State: open

I'm using a site that claims to be using your library, bear in mind I could be looking at a bug that you have already fixed.

http://developer.netflix.com/resources/OAuthTest

It seems that you don't normalize the URI as per the RFC:

http://tools.ietf.org/html/rfc5849#section-3.4.1.2

If you append something like "?a=b&c=d" to the URI, it is not stripped from the base string that you use to generate the OAuth signature.

I've discovered this when trying to diagnose problems with a 3rd party's OAuth implementation and they are pointing at the Netflix site as a reference implementation to test people's signing code against.