sometimeleft/stl-oauth-client — pull request #3 by jonah-carbonfive (2012-06-29 19:13:27+00:00)
Title: Uuid nonce generation

Includes https://github.com/sometimeleft/stl-oauth-client/pull/1

Replaces the existing nonce generation scheme. While the existing nonce generation function was generally valid it was also confusing, inefficient, and not necessarily thread safe.
Nonce values are not secret and no not need to be unpredictable. OAuth1 only requires that a given client not reuse the same nonce within the same timestamp (where timestamps are precise to the second). There are therefore two common approaches to generating a nonce.

1. Pick a simple value and increment it with each request. Store the last used value in some thread safe and globally available location so that all requests from the client always use a unique value. Reset the values when the timestamp changes.
2. Generate a random nonce with an appropriately strong PRNG such that the chance of a collision within the same timestamp in infinitesimal.

Combining both approaches offers no clear benefit. We have the computational expense of generating a "random" nonce but one which is so weakly random that it often repeats so we also have the memory expense of storing a set of all used nonce values. In addition since access to `nonceHistory` isn't thread safe concurrent requests might also generate nonce collisions.

This change was further motivated by a server side OAuth implementation we encountered which incorrectly cached used nonce values and would reject requests with identical nonces on different timestamps which should have been accepted.

This pull requests switches to use `CFUUID` to create nonce strings. This eliminates the need for `nonceHistory`, simplifies the nonce generation method, and provides globally unique nonces which are tolerated by the problematic server implementation we encountered.