Oauth protocol analysis 1

Time: Author: shaoyun

These analyses are based on the oauth protocol and Sina development documentation. Refer to the PHP, C # SDK, submit the test with Fiddler.

Part 1: Obtain the unauthorized request token and the corresponding request token secret

Submission address:

Http://api.t.sina.com.cn/oauth/request_token

Submission method: Get

Parameter List:

Oauth_consumer_key the apikey we applied
Oauth_nonce random value. A 32-bit MD5 value is randomly generated based on the time.
Oauth_signature parameter Signature
Oauth_signature_method Signature Algorithm
The integer value of the current timestamp obtained by oauth_timestamp
Oauth_version oauth Protocol version

The string to be signed is as follows:
Get & HTTP % 3A % 2f % signature % 2 foauth % signature & signature % 3d8888888% 26oauth_nonce % signature % 3dhmac-sha1% 26oauth_timestamp % 3d1288149739% 26oauth_version % 3d1. 0a

The parameter is decomposed as % 3d =, % 26 is &

Get
Http://api.t.sina.com.cn/oauth/request_token
Oauth_consumer_key = 888888888
Oauth_nonce = 08e59bdb879d2f4b96eb20158d7a5b47
Oauth_signature_method = HMAC-SHA1
Oauth_timestamp = 1288149739
Oauth_version = 1.0a

Between the first parameter and the second parameter, use & to connect between the second parameter and the third parameter, and urlencode for the third parameter. This is the string to be signed.

Signature Algorithm, here we use HMAC-SHA1, key for app secret, the applied

$ Key = 'e547036cd665c647f4561ede6820fde0 &';
Base64_encode (hash_hmac ('sha1', $ base_string, $ key, true ));

Signature generated
Oauth_signature = urlencode ('5qkdzysrnlaseeoccxtm7hspdyi = ');

The final get address is
Http://api.t.sina.com.cn/oauth/request_token? Oauth_consumer_key = 888888888 & oauth_nonce = signature & oauth_signature = signature % 3d & oauth_signature_method = HMAC-SHA1 & oauth_timestamp = 1288149739 & oauth_version = 1.0a

The string returned by the server after successful submission is as follows:
Oauth_token = 78ad5974c2b5c3a9de0fca3d1698470f & oauth_token_secret = 7e3c4cce0585101bc4b931136ba7ed90

This is the obtained unauthorized request token and the corresponding request token secret.

 

This is only an analysis. It has nothing to do with the platform language. The specific implementation is based on the situation. This is the first step of authentication. Later, it is similar to this, and there is time to write it again.