Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

removed parameter "body" in authorization header in post() method to fix OAuth1.0a authorization error #88

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

nayutads
Copy link

When you use post() method with oauth1.0a user context authorization, you should get error response "Unauthorized".
Indeed "Unauthorized" error problem like issue #39 has solved with PR #44, but it may be only case that is authorized with bearer token.
The post request path shown in issue #39 demands only bearer token, but not user context authentication.
https://developer.twitter.com/en/docs/twitter-api/tweets/filtered-stream/api-reference/post-tweets-search-stream-rules

Some post request path need OAuth1.0a user context authentication, so current code doesn't work well when you use other post request path.
A purpose of this PR is just fix it.

It is seemed that caused by embeded body in the generating authorization header method.
I've read the twitter API documentation and it doesn't seem to say that this is required.
But twitter oauth library demands request data because of generating oauth signature.

I think the reason why current code doesn't work well is Twitter API specification change between v1.1 and v2 described as above.
In API v1.1, most of the post request parameters are sent as query parameters.
But, in API v2, some of the post request parameters are sent as JSON body. And it is sent with 'Content-Type': 'application/json' in current code.
According to OAuth1.0a specification,request parameters can be "signature base string" when content type is application/x-www-form-urlencoded.
but if it's other content type,it is not specified.
https://oauth.net/core/1.0a/#anchor13
(I'm sorry if I'm just not reading it properly)

That's why I commited just 1 line code.

Here's temporary test code what I've prepared for this job.
Current code fails following test code.(returned Unauthorized Error by API)
(※ This code needs some additional environment variable)

testing post mute

import { expect } from "chai";

import Twitter from "../src/twitter";

describe("user context1.0a post mute", () => {
  it("should mute user", async () => {
    const client = new Twitter({
      consumer_key: process.env.TWITTER_CONSUMER_KEY,
      consumer_secret: process.env.TWITTER_CONSUMER_SECRET,
      access_token_key: process.env.TWITTER_ACCESS_TOKEN,
      access_token_secret: process.env.TWITTER_ACCESS_TOKEN_SECRET,
    });

    const mute_user = process.env.MUTE_TARGET_USER_ID;
    const myid = process.env.YOUR_TWITTER_ID;
    const { data: result } = await client.post(`users/${myid}/muting`, {
      target_user_id: mute_user,
    });

    expect(result).to.not.be.empty;
    expect(result).to.include({ muting: true });
  });
});

Sorry for my awkward request.
I'm not used to use github.
If I'm doing something wrong in this request, or if I've just coded post() method as wrong usage,
please discard it and fix this error.
(Should I just post issue first?)

@sherlaimov
Copy link

I wonder why this has not been merged yet?
I'm having a problem with this exact issue & removing the body from Authorization request does solve it.

@daneden
Copy link

daneden commented Nov 19, 2021

I came here after experiencing authentication issues too! Can confirm that removing the body from the authorisation header fixes the issue and allows me to post to the "tweets" v2 endpoint.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants