Skip to content

OAuth1 signature is generated incorrectly when using non-ASCII symbols in request parameters #1945

Closed
@julianpetriv

Description

@julianpetriv

Describe the bug
If we use OAuth1 authentication (restClient.Authenticator = OAuth1Authenticator.ForProtectedResource(...)) and have some non-ASCII symbols in our request parameters (it failed when using '£') oauth_signature is generated not correctly.
I think this is because you skipped part of OAuth1 algorithm where we encode our params to UTF-8, it should be done before we URL-encode them. Here is the method that is doing URL-encode:

public static IEnumerable<string> SortParametersExcludingSignature(WebPairCollection parameters)

To Reproduce
Imagine we have a param:
products=[{"id":5,"price":"£55"}]
Currently we are just URL-encoding it using this line:

=> string.Join("", value.Select(x => Unreserved.Contains(x) ? x.ToString() : $"%{(byte)x:X2}"));

In the end we have something like this:
products%3D%5B%7B%22id%22%3A5%2C%22price%22%3A%22%A355%22%7D%5D

Expected behavior
Starting param:
products=[{"id":5,"price":"£55"}]
After UTF-8 encode (e.g. using this site https://cafewebmaster.com/online_tools/utf8_encode) we should have this:
products=[{"id":5,"price":"£55"}]
And only after that we need to URL-encode it:
products%3D%5B%7B%22id%22%3A5%2C%22price%22%3A%22%C2%A355%22%7D%5D
The difference is we have %C2%A3 instead of %A3.

Desktop:

  • OS: Windows 11
  • .NET Framework 4.6.1
  • Version 108.0.1

Additional context
There is a very useful site for OAuth1 that helped me to find a problem. This is a sandbox that shows the algorithm to generate signature step by step: http://lti.tools/oauth/

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions