search

ddo / oauth-1.0a

OAuth 1.0a Request Authorization for Node and Browser
MIT License
325 stars 116 forks source link

Not to standard: Raw body is include in the signature base string #110

Open Ian1971 opened 3 years ago

Ian1971 commented 3 years ago

According to the oauth1a standard the body should only be included under certain specific conditions:

https://datatracker.ietf.org/doc/html/rfc5849#section-3.4.1.3

 o  The HTTP request entity-body, but only if all of the following
      conditions are met:

      *  The entity-body is single-part.

      *  The entity-body follows the encoding requirements of the
         "application/x-www-form-urlencoded" content-type as defined by
         [W3C.REC-html40-19980424].

      *  The HTTP request entity-header includes the "Content-Type"
         header field set to "application/x-www-form-urlencoded".

In particular it seems that this library is always including the body regardless of the content-type.

The issue was alluded to in this issue https://github.com/ddo/oauth-1.0a/issues/60 but I don't think any changes were made to the library. The OP there indicates he hacked it to not include the body based on a parameter.