Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix asterisk encoding issue #969

Closed
wants to merge 4 commits into from

Conversation

summera
Copy link
Contributor

@summera summera commented Mar 28, 2020

This fixes #677 by passing a custom HTTP::FormData::Urlencoded instance with a custom form encoder for post requests. This functionality is now available in http v4.4 (see httprb/http#599). An good explanation for why this is needed can be found in #677 (comment):

  • OAuth 1.0a (used by the Twitter API and implemented in this project using laserlemon/simple_oauth) requires the signature of a request to be computed over the request parameters encoded as described in RFC 3986, which states that * is to be replaced by %2A. (Twitter’s API docs are very clear about this, too.)
  • HTTP::FormData (used by this project to do the actual HTTP request) on the other hand encodes according to the rules of Ruby’s encode_www_form, which implements the HTML5 candidate recommendation, and for HTML5, * (0x2a) is not to be escaped anymore.
  • Twitter itself, when verifying the request, seems to compute the signature against the raw HTTP POST request, which will contain an unescaped asterisk produced by HTTP::FormData. But the signature we provide was made over a string containing an escaped asterisk as required by OAuth. Thus, the signature check fails and the tweet is rejected.

@johnjoubert
Copy link

johnjoubert commented Feb 5, 2021

👋 Bumping this PR. I ran into this bug today. It would be great to pick this one up again.

@lloydwatkin
Copy link

As are we :)

@kazunetakahashi
Copy link

I am in trouble about this issue, too. I hope that this fix comes soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Asterisks not encoded properly and result in error 32 "Could not authenticate you."
5 participants