0

I'm trying to work with the examples on the Twitter dev site but can't seem to get to the same signature as they have.

I am trying to complete step 3 on https://dev.twitter.com/docs/auth/implementing-sign-twitter because I am getting an error "Invalid or expired token" but I know it isn't because I've only just been given it, so it must be something wrong with my data packet.

The code I am using to try and generate this is:

// testing bit
$oauth = array(
        'oauth_consumer_key'=>'cChZNFj6T5R0TigYB9yd1w',
        'oauth_nonce'=>'a9900fe68e2573b27a37f10fbad6a755',
        'oauth_signature_method'=>'HMAC-SHA1',
        'oauth_timestamp'=>'1318467427',
        'oauth_token'=>'NPcudxy0yU5T3tBzho7iCotZ3cnetKwcTIRlX0iwRl0',
        'oauth_version'=>'1.0'            
);            
$this->o_secret = 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE';
$this->c_secret = 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw';    

ksort($oauth);

$string = rawurlencode(http_build_query($oauth));

$new_string = strtoupper($http_method).'&'.rawurlencode($main_url[0]).'&'.$string;

// The request_token request doesn't need a o_secret because it doesn't have one!
$sign_key = strstr($fullurl,'request_token') ? $this->c_secret.'&' : $this->c_secret.'&'.$this->o_secret; 

echo urlencode(base64_encode(hash_hmac('sha1',$new_string,$sign_key,true)));exit;

And I'm assuming that the keys listed on this page are in fact correct: https://dev.twitter.com/docs/auth/creating-signature. So in that case the signature should be 39cipBtIOHEEnybAR4sATQTpl2I%3D.

If you can spot what I'm missing that would be great.

2
  • I don't think you're supposed to be sharing your *_secret tokens publicly. They are secret for a reason.
    – esqew
    Aug 13, 2014 at 15:51
  • Thanks - no these come from Twitters official site. I was trying to replicate their examples to see what I am doing wrong.
    – Ukuser32
    Aug 14, 2014 at 8:25

3 Answers 3

0

Your consumer secret and token secret are incorrect for the page you reference. If you look further up the page you can see that they should be:

Consumer secret: L8qq9PZyRg6ieKGEKhZolGC0vJWLw8iEJ88DRdyOg
Token secret: veNRnAWe6inFuo8o2u8SLLZLjolYDmDP7SzL0YfYI

Also in Step 3 you need to include the oauth_verifier in the list of parameters when calculating your signature base string.

I'm not familiar with PHP so I haven't checked your code to calculate the signature.

1
0

This code has now worked - I will tidy it up from there :)

    // This function is to help work out step 3 in the process and why it is failing
    public function testSignature(){
            // testing bit
            $oauth = array(
                    'oauth_consumer_key'=>'cChZNFj6T5R0TigYB9yd1w',
                    'oauth_nonce'=>'a9900fe68e2573b27a37f10fbad6a755',
                    'oauth_signature_method'=>'HMAC-SHA1',
                    'oauth_timestamp'=>'1318467427',
                    'oauth_token'=>'NPcudxy0yU5T3tBzho7iCotZ3cnetKwcTIRlX0iwRl0',
                    'oauth_version'=>'1.0'            
            );

            $this->o_secret = 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE';
            $this->c_secret = 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw';    

            ksort($oauth);

            $string = http_build_query($oauth);

            $new_string = strtoupper($http_method).'&'.$main_url[0].'&'.$string;

            $new_string = 'POST&https%3A%2F%2Fapi.twitter.com%2F1%2Fstatuses%2Fupdate.json&include_entities%3Dtrue%26oauth_consumer_key%3Dxvz1evFS4wEEPTGEFPHBog%26oauth_nonce%3DkYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1318622958%26oauth_token%3D370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb%26oauth_version%3D1.0%26status%3DHello%2520Ladies%2520%252B%2520Gentlemen%252C%2520a%2520signed%2520OAuth%2520request%2521';

            // The request_token request doesn't need a o_secret because it doesn't have one!
            $sign_key = $this->c_secret.'&'.$this->o_secret; 

            echo 'Should be: tnnArxj06cWHq44gCs1OSKk/jLY=<br>';
            echo 'We get: '.base64_encode(hash_hmac('sha1',$new_string,$sign_key,true));
            exit;    
    }
0

you want to access token from twitter and sign in implementation you can see in this example.

1) http://www.codexworld.com/login-with-twitter-using-php/

and this one for timeline tweets

2) http://www.codexworld.com/create-custom-twitter-widget-using-php/

may be this help you .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.