OAUTH issue Cannot mimic POSTMAN request

[achadee]

Hi we have a working application that connects to multiple ecommerces such as Magento and Wocommerce

Its worth noting that we have existing customers that have no problems with the current setup. One of our customers using Magento (OAuthV1a) seems to have an interesting configuration. Every request I make returns:

{
  "messages": {
    "error": [
      {
        "code": 401,
        "message": "oauth_problem=signature_invalid"
      }
    ]
  }
}

I was trying to debug this is POSTMAN and I managed to get it working with minimal effort... is there something POSTMAN is doing that faraday can't do?

faraday = Faraday.new(url: @credentials[:api_url], headers: {"Accept" => "application/json", "Content-Type" => "application/json"}) do |faraday|
        faraday.request :url_encoded
        faraday.request :oauthenticator_signer, {signature_method: "HMAC-SHA1", consumer_key: @credentials[:api_key], consumer_secret: @credentials[:api_secret], token: @credentials[:access_token], token_secret: @credentials[:access_token_secret]}
        faraday.response :json
        faraday.response :logger
        faraday.adapter :typhoeus
      end

      return faraday

[iMacTia]

Hi @achadee, just to have a clearer idea:

1. Is oauthenticator_signer a middleware you wrote? Which request elements does it use to compute the signature?
2. Are you using the oauthenticator_signer to call other APIs and is it working?

[achadee]

1. oauthenticator_signer is found here: https://github.com/notEthan/oauthenticator

   It uses an Authorization header built from:

:signature_method => 'HMAC-SHA1',
  :consumer_key => 'a consumer',
  :consumer_secret => 'a consumer secret',
  :token => 'a token',
  :token_secret => 'a token secret'

Ive entered this data into POSTMAN and it works first time, I also suspect its to do with url encoding, or double encoding

2. correct

ps. sorry i posted this issue here, the middleware gem looked relatively inactive and I thought I wouldn't get a response

[iMacTia]

Don't worry @achadee and thanks for the link.

To be honest I think the issue you're having should be first risen with the authors of the middleware, so I would strongly suggest you to open an issue there. It could be due to a special case that they're not managing or anyway related to that gem as that's the component calculating the signature. Even if the error is not on their side, they will probably help you much quickly to identify the issue as they know better than us how the gem work. I understand the gem look inactive, but you'll never know if you don't try, and this is really something that they should look into, not us. If they find out that the issue lies on Faraday, then we can start from there, but right now I feel like walking in the dark.

However, I still would like to try helping you out as there's something I noticed. In the gem ReadMe, they state:

The middleware should be in the stack immediately before the adapter. Any other middleware that modifies the request between OAuthenticator signing it and the request actually being made may render the signature invalid.

This can actually just be useless, but I would suggest you change the initialiser following their advice:

faraday = Faraday.new(url: @credentials[:api_url], headers: {"Accept" => "application/json", "Content-Type" => "application/json"}) do |faraday|
  faraday.request :url_encoded
  faraday.response :json
  faraday.response :logger
  faraday.request :oauthenticator_signer, {signature_method: "HMAC-SHA1", consumer_key: @credentials[:api_key], consumer_secret: @credentials[:api_secret], token: @credentials[:access_token], token_secret: @credentials[:access_token_secret]}
  faraday.adapter :typhoeus
end

Other questions to help you find the issue while you wait for them to reply:

1. Is there anything different you're doing between this connection and the others? Adapter, middlewares, headers, something special in the body, anything?
2. Are you using the Typhoeus adapter coming from the gem? As the integrated one we have is not compatible with latest versions and could lead to unexpected behaviours.
3. Are you sure that all the parameters you pass to oauthenticator_signer are correct? What @credentials?

[achadee]

Thanks, I've pushed an issue now

[notEthan]

I'm the author of oauthenticator. I think this can be safely closed as not a faraday issue. it's not resolved (haven't heard back from the reporter on https://github.com/notEthan/oauthenticator/issues/22 ) but I don't see any issue with faraday that would cause this.

[iMacTia]

Hi @notEthan and thanks for your feedback. I'll close this Issue then and hope that this issue can be solved with your help. Thanks