rsieiro / RSOAuthEngine

ARC based OAuth engine for MKNetworkKit
http://rodrigo.sharpcube.com
150 stars 33 forks source link

Signing for POST of JSON data #19

Closed wcwynn closed 11 years ago

wcwynn commented 11 years ago

POST body parameters are used in the signature of the base string without regarding to the content-type of the POST request.

Section 9.1.1. of the oauth 1.0a spec says that these parameters should only be added if the content-type is x-www-form-urlencoded See here: http://oauth.net/core/1.0a/#anchor13

I think the current implementation needs to consider the content type before adding the body parameters here: https://github.com/rsieiro/RSOAuthEngine/blob/master/RSOAuthEngine/RSOAuthEngine.m#L219

wcwynn commented 11 years ago

Here is a better spec reference: http://tools.ietf.org/html/rfc5849#section-3.4.1.3.1

The relevant code should be wrapped with:

if ( [request postDataEncoding] == MKNKPostDataEncodingTypeURL ) {
}
rsieiro commented 11 years ago

Fixed. Thanks for pointing it out!