Tumblr - oauth_signature does not match expected value - oauth

There are already topics on this topic, but I have not been able to solve the problem on my side.
I develop a driver of auth for AdonisJS Ally and Tumblr, I get this error after the callback. However, oAuthToken, requestToken.oAuthTokenSecret and oAuthVerifier are correct (at least, I think).
The response is:
error { statusCode: 401, data: 'oauth_signature does not match
expected value' }
The request token URL:
https://www.tumblr.com/oauth/request_token?oauth_consumer_key=Vv3XfKpkZAXAehLxk9h76cjPkUyq7iDnqMjmEKwqKrOriGSVoG&oauth_nonce=fd47a26a06ceb6ce20121bc98ac78a01&oauth_signature=Hkhvn1n5kgjg9P0IeKwvqKT9j3I%3D&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1323327331&oauth_version=1.0

var request = require("request");
var oauth ={
consumer_key: "****************************",
consumer_secret: "****************************"
};
var url = 'https://www.tumblr.com/oauth/request_token'
request.post({url:url, oauth:oauth}, function (e, r, body) {
var temp1 = body.split("&");
var auth_token=temp1[0].split("=")[1];
var auth_secret=temp1[1].split("=")[1];
var tokens=[auth_token,auth_secret];
console.log(temp1)
cb(undefined,{d:tokens});
})
this code worked to me, try this.
There is no proper documentation for tumblr, but from the doc what i understood is there are 3 ways to get authenticated in tumblr and receive auth_token and auth_token secret the above code might not work because there is change of auth_nonce and auth_signature and hence you receive the error as
oauth_signature does not match expected value so i would suggest to use my method to generate the auth_token and auth_token_secret. this code works without adding any signature and nonce

Related

Google Drive Invalid scope for OAuth 2.0 for TV and Limited-Input Device Applications GODOT

I'm using the OAuth 2.0 for TV and Limited-Input Device Applications in my Godot project. The scopes allowed are (https://developers.google.com/identity/protocols/oauth2/limited-input-device?authuser=1#allowedscopes).
OpenID Connect, Google Sign-In
email
openid
profile
Drive API
https://www.googleapis.com/auth/drive.appdata
https://www.googleapis.com/auth/drive.file
YouTube API
https://www.googleapis.com/auth/youtube
https://www.googleapis.com/auth/youtube.readonly
Below is my Godot (gdscript) function to send the request (clientID is a var with my generated OAuth 2.0 Client ID):
func _make_post_request():
var oAuthEntry = "https://oauth2.googleapis.com/device/code";
var params = "scope=email%20profile%20https://www.googleapis.com/auth/youtube&";
params += "client_id=" + clientID;
# Add 'Content-Type' header:
var headers = ["Content-Type: application/x-www-form-urlencoded"]
$HTTPRequest.request(oAuthEntry, headers, true, HTTPClient.METHOD_POST, params)
This works correctly, for the OpenID and YouTube Scopes.
But when I try to use the Drive API Scopes I get an invalid scope return.
For example:
func _make_post_request():
var oAuthEntry = "https://oauth2.googleapis.com/device/code";
var params = "scope=https://www.googleapis.com/auth/drive.appdata&";
params += "client_id=" + clientID;
# Add 'Content-Type' header:
var headers = ["Content-Type: application/x-www-form-urlencoded"]
$HTTPRequest.request(oAuthEntry, headers, true, HTTPClient.METHOD_POST, params)
I get a return of:
{error:invalid_scope}
Does anybody know why the scope is invalid although it is listed on the allowed page (https://developers.google.com/identity/protocols/oauth2/limited-input-device?authuser=1#allowedscopes)
Posting this in case anyone else ends up here.
It seems that drive.appdata is the one not working. Try using just drive.files instead. (Just tried as of 2022-07-12)
Not sure why, and it's frustrating that this issue hasn't been addressed, but try going without drive.appdata

Exchange authorization_code for access_token and id_token not working using Auth0

I am using Auth0 sms passwordless login and I can login correctly and I am redirected correctly to my specified callback url: http://localhost:8000/authenticated?code=AUTHORIZATION_CODE. I have been following this tutorial but when I get to step 4 and 5 to exchange the authorization_code for the access_token and id_token I am getting this error message back: {"error":"access_denied","error_description":"Unauthorized"}.
This is how I am sending the code to the Auth0 server through a POST:
var code = request.query.code;
var url = `https://${process.env.AUTH0_CLIENT_DOMAIN}/oauth/token?client_id=${process.env.AUTH0_CLIENT_ID}&redirect_uri=http://localhost:8000/authenticated&client_secret=${process.env.AUTH0_CLIENT_SECRET}&code=${code}&grant_type=authorization_code`;
Wreck.post(url, (err, res, payload) => {
console.log(payload.toString());
});
Is there something that I am missing from my querystring? Or something I need to do before sending this post request?
My question was answered in an issue on the auth0 repo: https://github.com/auth0/auth0.js/issues/234
But I have reposted the answer here:
Post the payload, not send it as params in the query string:
var code = request.query.code;
var url = `https://${process.env.AUTH0_CLIENT_DOMAIN}/oauth/token`;
var body = {
client_id:process.env.AUTH0_CLIENT_ID,
redirect_uri:'http://localhost:8000/authenticated',
client_secret:process.env.AUTH0_CLIENT_SECRET,
code:code,
grant_type:'authorization_code'
};
Wreck.post(url, {payload:body}, (err, res, payload) => {
console.log(payload.toString());
});

OAuth1 Authentication in RestSharp for Twitter API GET and POST methods

Using Postman I'm successfully able to query and create tailored audiences using the Twitter API, using Postman's OAuth 1.0 Authorization. However when trying to do the same with RestSharp I get an Unauthorized error.
"UNAUTHORIZED_ACCESS" - "This request is not properly authenticated".
My GET request authenticates fine, but the POST request fails.
_twitterRestClient = new RestClient("https://ads-api.twitter.com/1")
{
Authenticator = OAuth1Authenticator.ForProtectedResource(ConsumerKey, ConsumerSecret, AccessToken, AccessSecret)
};
var restRequest1 = new RestRequest(string.Format("/accounts/{0}/tailored_audiences", TwitterAccountId), Method.GET);
//this works and gives me a list of my tailored audiences
var response1 = _twitterRestClient.Execute(restRequest1);
var restRequest2 = new RestRequest(string.Format("/accounts/{0}/tailored_audiences?name=SampleAudience2&list_type=EMAIL", TwitterAccountId), Method.POST);
// this results in an "Unauthorized" status code , and the message {\"code\":\"UNAUTHORIZED_ACCESS\",\"message\":\"This request is not properly authenticated\"}
var response2 = _twitterRestClient.Execute(restRequest2);
Turns out this is due to a quirk in RestSharp OAuth1 implementation. I think its related to this issue - https://www.bountysource.com/issues/30416961-oauth1-not-specifing-parameter-type . Part of creating an OAuth1 signature involves gathering all the parameters in the request and other details and then hashing it all. It looks like when the HTTP Method is a POST, then RestSharp is not expecting parameters in the querystring (which makes sense), its expecting them in the post body. Anyhow if you add parameters explicitly then they are picked up and the OAuth1 signing works. (Turns out the twitter API works if these params are in the post body, so I didn't need to explicitly add them to the query string). Updated code that now works:
_twitterRestClient = new RestClient("https://ads-api.twitter.com/1")
{
Authenticator = OAuth1Authenticator.ForProtectedResource(ConsumerKey, ConsumerSecret, AccessToken, AccessSecret)
};
var restRequest1 = new RestRequest(string.Format("/accounts/{0}/tailored_audiences", TwitterAccountId), Method.GET);
var response1 = _twitterRestClient.Execute(restRequest1);
var restRequest2 = new RestRequest(string.Format("/accounts/{0}/tailored_audiences", TwitterAccountId), Method.POST);
restRequest2.AddParameter("name", "SampleAudience2");
restRequest2.AddParameter("list_type", "EMAIL");
var response2 = _twitterRestClient.Execute(restRequest2);

Google Script API + Oauth + Tumblr

Hello,
I'm trying to acess, perform a post, into Tumblr with Oauth api provided by Tumblr) http://tumblr.com/api). I'm using Google Script and I've tryied too many solutions but anyone worked. To implement i've basaed myself into this(https://developers.google.com/apps-script/articles/twitter_tutorial) Google script twitter tutorial, once on Tumblr API web page they say that twitter api is almost the same that tumblr.
Contextualizing,
I've already set the Oauth class methods with data below and substituted consumer and secret keys with values got from the api i've created.
var oauthConfig = UrlFetchApp.addOAuthService("tumblr");
oauthConfig.setAccessTokenUrl(
"http://www.tumblr.com/oauth/access_token");
oauthConfig.setRequestTokenUrl(
"http://www.tumblr.com/oauth/request_token");
oauthConfig.setAuthorizationUrl(
"http://www.tumblr.com/oauth/authorize");
oauthConfig.setConsumerKey(<i>consumerkey</i>);
oauthConfig.setConsumerSecret(<i>consumerSecret</i>);
Error,
The code below isnt working as it should be.
var requestData = {
"method": "POST",
"oAuthServiceName": "tumbler",
"oAuthUseToken": "always"
};
var result = UrlFetchApp.fetch(
"https://api.tumblr.com/v2/blog/{blog}.tumblr.com/post?type=text&body=word",
requestData);
The Script to Twitter is almost the same and it works. Im able to perform tweets.
var result = UrlFetchApp.fetch(
"https://api.twitter.com/1/statuses/update.json?status=" + tweet,
requestData);
Response From Server
Request failed for returned code 400. Server response: {"meta":{"status":400,"msg":"Bad Request"},"response":{"errors":["Post cannot be empty."]}}
Possible Solutions
A possible solution can work using this information(got from tumblr.com/api):
OAuth
The API supports the OAuth 1.0a Protocol, accepting parameters via the Authorization header, with the HMAC-SHA1 signature method only. There's probably already an OAuth client library for your platform.
My question is, what am I doing wrong?(my post inst empty, i have 2 params). Had anyone had the same problem? Someone has suggestions?
Thank You.
I don't know anything about the tumblr api, but your http post is empty (the oAuth parameters aren't in the post body, they're advanced options), the body of the post needs to go in the "payload" parameter. See the section "Advanced parameters" in the docs. Or, as you aren't using the post can't you use a get request instead? Remove the method: POST parameter (GET is the default).
Thank You very much Daniel. It worked now!!
Everybody that want use Tumblr + Google Script API + oAuth can use de code below to perform posts.
I created I Google Spreadsheet and then a script there. Before to be able to post I neded to create and app into tumblr.com/api and get secret and consumer keys. Also I've deployed the Google script as an web app(ensure that the version is the last one(the final code)) before to create a new version. After that you go tu publish > deploy as web app !
That twitter tutorial I put on my first question is the only path you need to conclude your job.
function authorize() {
var oauthConfig = UrlFetchApp.addOAuthService("tumblr");
oauthConfig.setAccessTokenUrl(
"http://www.tumblr.com/oauth/access_token");
oauthConfig.setRequestTokenUrl(
"http://www.tumblr.com/oauth/request_token");
oauthConfig.setAuthorizationUrl(
"http://www.tumblr.com/oauth/authorize");
oauthConfig.setConsumerKey(getConsumerKey());
oauthConfig.setConsumerSecret(getConsumerSecret());
var requestData = {
"oAuthServiceName": "tumblr",
"oAuthUseToken": "always"
};
var result = UrlFetchApp.fetch(
"http://api.tumblr.com/v2/blog/{your_blog}.tumblr.com/posts/queue",
requestData);
}
function doGet(e) {
var tweet = e.parameter.tumblr;
var app = UiApp.createApplication().setTitle("Approved");
var panel = app.createFlowPanel();
authorize();
var encodedTweet = encodeURIComponent(tweet);
var payload =
{
"body" : encodedTweet,
"type" : "text"
};
var requestData = {
"method" : "POST",
"oAuthServiceName": "tumblr",
"oAuthUseToken": "always",
"payload" : payload
};
try {
var result = UrlFetchApp.fetch(
"https://api.tumblr.com/v2/blog/{your_blog}.tumblr.com/post",
requestData);
panel.add(app.createLabel().setText("You have approved: \"" + tweet + "\""));
} catch (e) {
Logger.log(e);
panel.add(app.createLabel().setText(e));
}
app.add(panel);
return app;
}

Shopify: Problems Getting OAuth Access Token

I've retrieved the authorization code in Step 1 of OAuth without a problem, but for the life of me I can't complete a post to get the access token. I always get the same error:
content: "{"error":"invalid_request","error_description":"Could not find Shopify API appli... (length: 103)"
Here's what my code looks like...Meteor.http.post is a standard post request. I've tried all sorts of combinations without any luck. I'm developing on localhost:
var url = 'https://' + shopName + '/admin/oauth/access_token';
var data = { client_id: apiKey, client_secret: secret, code: code };
Meteor.http.post(url, data,
function(error, result) {
debugger;
});
Meteor.post is a standard server-side post request documented here. I've tried params (like the Node Wrapper), an array (like PHP) and a combination of other things. I have no idea.
Is it because I'm developing on localhost and server calls require https now? Is my post data structure wrong?
Any other ideas what I'm doing wrong?
I know you said you tried params but placing the params in as data like that wouldn't work. Try this..
var url = 'https://' + shopName + '/admin/oauth/access_token';
var data = { client_id: apiKey, client_secret: secret, code: code };
Meteor.http.post(url, {params:data},
function(error, result) {
debugger;
});

Resources