AFNetworking/AFOAuth1Client — pull request #33 by jnormore (2013-03-19 05:12:33+00:00)
Title: Updates request factory to not use url or post params due to Authorization header

Requests should not use url or post params if Authorization header is used, see

http://oauth.net/core/1.0/ (5.2. Consumer Request Parameters) states that it should be one of Authorization header, POST params, or URL params (preference in that order).

Twitter API also has issues with this, https://dev.twitter.com/docs/api/1/post/oauth/request_token, states "If you're using HTTP-header based OAuth, you shouldn't include oauth_* parameters in the POST body or querystring"

Personally, I noticed this when using an API that uses django-piston, which creates a multi value dict for params so when there are duplicates I see invalid signatures.

This update removes the passing of the parameters argument to the request creation in requestWithMethod:path:parameters. The request created for the authorization step also had to be updated to use the url parameters because it was using this method before.