Mastercard / oauth1-signer-python

Python library for generating a Mastercard API compliant OAuth signature.
https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/
MIT License
29 stars 22 forks source link

[BUG] `oauth_signature` not encoded in versions 1.2.0 and 1.3.0 #35

Closed ech0s7r closed 3 years ago

ech0s7r commented 3 years ago

Bug Report Checklist

PR opened to fix the issue: https://github.com/Mastercard/oauth1-signer-python/pull/34

Description Requests are rejected when signed with the python library mastercard-oauth1-signer versions 1.2.0 and 1.3.0. The oauth_signature is not encoded as per https://datatracker.ietf.org/doc/html/rfc3986#section-2.1.

See the OAuth#getAuthorizationHeader implementation in oauth1-signer-java as reference:

...
// Signature
String signature = signSignatureBaseString(sbs, signingKey, charset);
oauthParams.put("oauth_signature", Util.percentEncode(signature, charset));
...

To Reproduce

  1. Make a request using version 1.2.0 or 1.3.0
  2. The oauth_signature in the Authorization header is not encoded
  3. Note the generated oauth_signature param: GgLIi0W5+prHjxJHTLJuXKQZemxnJEdThw0y0nqQjFaDOwfgQqHw8C/3JReZ0AffrBtI2rs6I1xQk74hMOPoiAsQsIPO7pQ7vZlEk1nO3nO6uXebZ/tu2k0KLpwqYzBULAnuVZuhfSQG7oEI3qGbtI5u/tAv4P64zLY/vl36NB+KSYqONPBx04T12mk/rk1Xswh3aVEtXzycOvRHB+/3ydavXgGzHSg9WpzkyyQ4YmJajGcNwVZWgJGNl9ectr9KBrL6PmxHyS1fRI/aabEH6uFy3gGk9d4IMwm1hsU+Pwq0pS3AnBZpo26YpwVMDmyaoq5GmBZGUFONOiPNgQAwAg==

Expected behavior

ech0s7r commented 3 years ago

Closed with #34.