danielcrenna/hammock — pull request #52 by joelclermont (2011-11-21 20:44:55+00:00)
Title: parameters need to be encoded in two passes

When generating a signature block, all request parameters should be decoded, normalized, encoded, concatenated and then encoded again.

For example, take the following parameter collection (already decoded and normalized):

`oauth_consumer_key = tA3CzsVG2dr2WiC4HxwU49t4fkoRbXC2
oauth_token = 3oorxi5fm5iWTqCKxC4Xz9rt5sXw5yWo
oauth_nonce = 30mx65tsg7hi1wvd
oauth_timestamp = 1321906028
oauth_signature_method = HMAC-SHA1
oauth_version =1.0
parameters[owned_by] = me`

The next step should produce a parameter collection which looks like this:

`oauth_consumer_key=tA3CzsVG2dr2WiC4HxwU49t4fkoRbXC2&oauth_nonce=30mx65tsg7hi1wvd&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1321906028&oauth_token=3oorxi5fm5iWTqCKxC4Xz9rt5sXw5yWo&oauth_version=1.0¶meters%5Bowned_by%5D=me`

(Note that the [ and ] characters in the final parameter name were encoded)

This encoded parameter collection should then be encoded again as a whole and appended to the HTTP method and URL. It would look something like this:

`GET&http%3A%2F%2Fwww.h2oscore.com%2Fapi%2Fv1%2Faddress&oauth_consumer_key%3DtA3CzsVG2dr2WiC4HxwU49t4fkoRbXC2%26oauth_nonce%3D30mx65tsg7hi1wvd%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1321906028%26oauth_token%3D3oorxi5fm5iWTqCKxC4Xz9rt5sXw5yWo%26oauth_version%3D1.0%26parameters%255Bowned_by%255D%3Dme`

The part of that block which I am drawing attention to is at the end: `parameters%255Bowned_by%255D%3Dme`

Without this pull request, it instead generates: `parameters%5Bowned_by%5D%3Dme`

This will cause the OAuth request to be invalid, as the signature will not match what the server is expecting.

Regarding my particular fix, I'm not sure if this is the best way. I made a modification to your CollectionExtensions.Concatenate function. Internally, I'm encoding the Key and Value (using your existing static method). As far as I can tell, this particular function isn't used anywhere else in Hammock, but if it was (or if you wanted to in the future), this may not be an appropriate place to path the encoding bug.

References:
http://hueniverse.com/oauth/guide/authentication/
http://tools.ietf.org/html/rfc5849#section-3.4.1.3