问题：

Twitter oauth无效oauth_verifier参数

拓拔耀

2023-03-14

我正在用Java实现oauth，顺序如下：

1）发送帖子https://api。啁啾com/oauth/request_token（带回调）Twitter响应包含oauth_token、oauth_token_secret和oauth_callback_confirm=true

2）正在重定向到https://api。啁啾com/oauth/authenticate？oauth_token={oauth_token来自twitter之前的响应}

3） Twitter登录表单出现时，我点击“登录”按钮。

4） Twitter重定向到{callback_url}？oauth_令牌={此令牌等于oauth/request_令牌响应中的令牌}

5）发布https://api。啁啾带有oauth头的com/oauth/access_令牌包括oauth_令牌，消息体包含oauth_验证器={返回的验证器}

6） Twitter response=处理OAuth请求时出错：OAuth_验证器参数无效

oauth_验证器有什么问题？

计算签名方法：

private static String computeSignature(String baseString, String keyString) throws GeneralSecurityException, UnsupportedEncodingException {
        SecretKey secretKey = null;

        byte[] keyBytes = keyString.getBytes();
        secretKey = new SecretKeySpec(keyBytes, "HmacSHA1");

        Mac mac = Mac.getInstance("HmacSHA1");
        mac.init(secretKey);

        byte[] text = baseString.getBytes();

        return new String(Base64.encodeBase64(mac.doFinal(text))).trim();
    }

第一次请求的代码：

String oauth_signature_method = "HMAC-SHA1";

    // generate any fairly random alphanumeric string as the "nonce".
    String uuid_string = UUID.randomUUID().toString();
    uuid_string = uuid_string.replaceAll("-", "");
    String oauth_nonce = uuid_string;

    // get the timestamp
    Calendar tempcal = Calendar.getInstance();
    long ts = tempcal.getTimeInMillis();
    String oauth_timestamp = (new Long(ts / 1000)).toString(); 
    String parameter_string = "oauth_callback=" + OauthConstants.TWITTER_OAUTH_CALLBACK 
            + "&oauth_consumer_key=" + OauthConstants.TWITTER_OAUTH_CONSUMER_KEY
            + "&oauth_nonce=" + oauth_nonce + "&oauth_signature_method="
            + oauth_signature_method + "&oauth_timestamp=" + oauth_timestamp + "&oauth_version=1.0";
    String signature_base_string = get_or_post + "&" + encode(twitter_endpoint) + "&" + encode(parameter_string);
    String oauth_signature = "";

    try {
        oauth_signature = computeSignature(signature_base_string, OauthConstants.TWITTER_OAUTH_CONSUMER_SECRET + "&");  
    } catch (GeneralSecurityException | UnsupportedEncodingException e) {
       ...}

String twitter_endpoint = "https://api.twitter.com/oauth/request_token";
String authorization_header_string = "OAuth oauth_callback=\"" + OauthConstants.TWITTER_OAUTH_CALLBACK
                + "\",oauth_consumer_key=\"" + OauthConstants.TWITTER_OAUTH_CONSUMER_KEY
                + "\",oauth_signature_method=\"HMAC-SHA1\",oauth_timestamp=\"" + oauth_timestamp
                + "\",oauth_nonce=\"" + oauth_nonce + "\",oauth_version=\"1.0\",oauth_signature=\""
                + encode(oauth_signature) + "\"";

// Apache httpcore 4.4.1
HttpProcessor httpproc = HttpProcessorBuilder.create()
                .add(new RequestContent())
                .add(new RequestTargetHost())
                .add(new RequestConnControl())
                .add(new RequestUserAgent("ApacheHttp/1.1"))
                .add(new RequestExpectContinue(true)).build();

        HttpRequestExecutor httpexecutor = new HttpRequestExecutor();
        HttpCoreContext context = HttpCoreContext.create();
        HttpHost host = new HttpHost(twitter_endpoint_host, 443); 
        DefaultBHttpClientConnection conn = new DefaultBHttpClientConnection(8 * 1024);

        context.setAttribute(HttpCoreContext.HTTP_CONNECTION, conn);
        context.setAttribute(HttpCoreContext.HTTP_TARGET_HOST, host);

try {
                // initialize the HTTPS connection
                SSLContext sslcontext = SSLContext.getInstance("TLS");
                sslcontext.init(null, null, null);
                SSLSocketFactory ssf = sslcontext.getSocketFactory();
                Socket socket = ssf.createSocket();
                socket.connect(new InetSocketAddress(host.getHostName(), host.getPort()), 0);
                conn.bind(socket);

                BasicHttpEntityEnclosingRequest request2 = new BasicHttpEntityEnclosingRequest("POST", twitter_endpoint_path, HttpVersion.HTTP_1_1);
                request2.setEntity(new StringEntity("", "UTF-8"));
                request2.addHeader("Authorization", authorization_header_string); 
                httpexecutor.preProcess(request2, httpproc, context);
                HttpResponse response2 = httpexecutor.execute(request2, conn, context);
                httpexecutor.postProcess(response2, httpproc, context);
} catch(Exception e) {} ...

第二个请求的代码（重定向到https oauth/authenticate）

public JSONObject getTwitterAuthorizationCodeFromRequestToken(String oauth_token) {
...
        String twitter_endpoint = "https://api.twitter.com/oauth/authenticate";

        ExternalContext externalContext = FacesContext.getCurrentInstance().getExternalContext();
        try {
            FacesContext.getCurrentInstance().getExternalContext().redirect(twitter_endpoint  + "?oauth_token=" + encode(oauth_token));
        } catch (IOException ex) {...}
...
    }

第三次请求代码（POST oauth/access_令牌）

    public JSONObject getTwitterAccessTokenFromAuthorizationCode(String verifier_or_pin, String oauth_token) {
    ...
 String oauth_signature_method = "HMAC-SHA1";

    // generate any fairly random alphanumeric string as the "nonce". Nonce = Number used ONCE.
    String uuid_string = UUID.randomUUID().toString();
    uuid_string = uuid_string.replaceAll("-", "");
    String oauth_nonce = uuid_string; 

    Calendar tempcal = Calendar.getInstance();
    long ts = tempcal.getTimeInMillis();
    String oauth_timestamp = (new Long(ts / 1000)).toString(); 

    // the parameter string must be in alphabetical order
    String parameter_string = "oauth_consumer_key=" + OauthConstants.TWITTER_OAUTH_CONSUMER_KEY 
                            + "&oauth_nonce=" + oauth_nonce + "&oauth_signature_method=" + oauth_signature_method
                            + "&oauth_timestamp=" + oauth_timestamp + "&oauth_token=" + encode(oauth_token) + "&oauth_version=1.0";

    String signature_base_string = get_or_post + "&" + encode(twitter_endpoint) + "&" + encode(parameter_string);

    String oauth_signature = "";
    try {
        oauth_signature = computeSignature(signature_base_string, OauthConstants.TWITTER_OAUTH_CONSUMER_SECRET + "&");
    } catch (GeneralSecurityException | UnsupportedEncodingException e) {
        ...
    }

    String authorization_header_string = "OAuth oauth_consumer_key=\"" + OauthConstants.TWITTER_OAUTH_CONSUMER_KEY  
                                               + "\",oauth_signature_method=\"HMAC-SHA1\",oauth_timestamp=\"" + oauth_timestamp
                                               + "\",oauth_nonce=\"" + oauth_nonce + "\",oauth_version=\"1.0\",oauth_signature=\"" 
                                               + encode(oauth_signature) + "\",oauth_token=\"" + encode(oauth_token) + "\"";

    HttpProcessor httpproc = HttpProcessorBuilder.create()
                    .add(new RequestContent())
                    .add(new RequestTargetHost())
                    .add(new RequestConnControl())
                    .add(new RequestUserAgent("ApacheHttp/1.1"))
                    .add(new RequestExpectContinue(true)).build();

            HttpRequestExecutor httpexecutor = new HttpRequestExecutor();
            HttpCoreContext context = HttpCoreContext.create();
            HttpHost host = new HttpHost(twitter_endpoint_host, 443); 
            DefaultBHttpClientConnection conn = new DefaultBHttpClientConnection(8 * 1024);

            context.setAttribute(HttpCoreContext.HTTP_CONNECTION, conn);
            context.setAttribute(HttpCoreContext.HTTP_TARGET_HOST, host);

    try {
                    SSLContext sslcontext = SSLContext.getInstance("TLS");
                    sslcontext.init(null, null, null);
                    SSLSocketFactory ssf = sslcontext.getSocketFactory();
                    Socket socket = ssf.createSocket();
                    socket.connect(new InetSocketAddress(host.getHostName(), host.getPort()), 0);
                    conn.bind(socket);

                    BasicHttpEntityEnclosingRequest request2 = new BasicHttpEntityEnclosingRequest("POST", twitter_endpoint_path);
                    // Including oauth_verifier value to request body
                    request2.setEntity(new StringEntity("oauth_verifier=" + encode(verifier_or_pin), "UTF-8"));
                    request2.addHeader("Authorization", authorization_header_string);
                    httpexecutor.preProcess(request2, httpproc, context);
                    HttpResponse response2 = httpexecutor.execute(request2, conn, context);
... 
    }

樊奇思

2023-03-14

我在JavaScript代码库中也遇到过同样的情况。经过一天的努力，我找到了解决错误的方法。这只是添加了一个值为“application/x-www-form-urlencoded”的“Content-Type”标题。

我的代码曾经正常工作，但它在过去几个月停止工作。我的猜测是Twitter最近更改了OAuth处理的实现，这迫使我们显式添加内容类型。

Twitter oauth无效oauth_verifier参数

共有1个答案

相关问答

相关文章

相关阅读

相关工具

相关文档