OAuth response invalid_signature - what parameters required to generate signature?
Asked by Kaus Chilweri:

Hi,

I'm trying to authenticate with OAuth and am having trouble getting an auth token. I keep getting the following response.

STATUS CODE:  
400 Bad Request

DETAILS:  
X-Dns-Prefetch-Control: off  
X-Frame-Options: DENY  
X-Download-Options: noopen  
X-Permitted-Cross-Domain-Policies: none  
Referrer-Policy: strict-origin-when-cross-origin  
Surrogate-Control: no-store  
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate  
Pragma: no-cache  
Expires: 0  
X-Trello-Version: 1.2317.0  
X-Trello-Environment: Production  
Access-Control-Allow-Origin: \*  
Access-Control-Allow-Methods: GET, PUT, POST, DELETE  
Access-Control-Allow-Headers: Authorization, Accept, Content-Type  
Access-Control-Expose-Headers: x-rate-limit-api-key-interval-ms, x-rate-limit-api-key-max, x-rate-limit-api-key-remaining, x-rate-limit-api-token-interval-ms, x-rate-limit-api-token-max, x-rate-limit-api-token-remaining  
Content-Type: text/plain; charset=utf-8  
Content-Length: 17  
Date: Mon, 04 Jan 2021 03:34:24 GMT  
X-Envoy-Upstream-Service-Time: 71  
Expect-Ct: report-uri="<https://web-security-reports.services.atlassian.com/expect-ct-report/trello-edge>", max-age=86400  
Strict-Transport-Security: max-age=63072000; preload  
X-Content-Type-Options: nosniff  
X-Xss-Protection: 1; mode=block  
Server: globaledge-envoy

RETURNED DATA:  
Invalid Signature

I'm using a language (AHK) that does NOT have a pre built library for Authorizing with Trello so have built my own.

I don't see it anywhere specified in the Trello docs as to what parameters will be used to generate the signature that will be checked on Trellos end. I believe I am using the correct data as laid out in [OAuth 1.0](http://tools.ietf.org/html/rfc5849) as specified on the [developer page](https://developer.atlassian.com/cloud/trello/guides/rest-api/authorization/#using-basic-oauth) .

The signatutre_base_string I'm generating my signature for is as follows (personal info masked)

```
GET&https%3A%2F%2Ftrello.com%2F1%2FOAuthGetRequestToken&oauth_callback%3D{CALLBACK_URL}%26oauth_consumer_key%{CONSUMER_KEY_HERE}%26oauth_nonce%3DMjgzNjk3NTcwNDYwNzEzODg3NDIzMjE2Nzg4MzkyNzk%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1609673662%26oauth_version%3D1.0
```

which generated the following Authorization Header

(personal info masked and added line breaks for readability)

```
Authorization: OAuth 
oauth_callback="{CALLBACK_URL}",
oauth_consumer_key="{CONSUMER_KEY_HERE}",
oauth_nonce="MjgzNjk3NTcwNDYwNzEzODg3NDIzMjE2Nzg4MzkyNzk",
oauth_signature="GR7Zk6bT2PaxjYpEzsdVAAi3CCc%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1609673662",
oauth_version="1.0"
```

I'm sure that I'm generating the signature correctly as I get the exact same signature when using any of the online HMAC-SHA1 signature generators.

I'm thinking that I might be missing some kind of required parameter that Trello is including when they generate the signature for verification.

Is there any document that lays out exactly what parameters need to be returned for the authorization? or what the header is expected to look like/contain?

Thanks


Answers:
author: Kaus Chilweri
body: I was able to figure out my issue, and hope this might help someone.

It turns out that I had an error in the generation of my Authorization header, which gave me an different signature than Trello calculated. I had failed to percent encode my callback url twice. It needs to be percent encoded when initially adding it to the parameter sting, and then a second time when the entire parameter string is percent encoded.

I was able to figure this out while using the authorization header generator located [here.](http://lti.tools/oauth/)


Tags: oauth

signature

validation