2

I am currently trying to request a token from Flickr to then be able to do some calls to their OAuth methods. I know I must be doing something wrong, for I get a reply that the signature is wrong, but honestly I followed their instructions (http://www.flickr.com/services/api/auth.oauth.html, http://www.flickr.com/services/api/auth.oauth.html#request_token, http://www.flickr.com/services/api/flickr.auth.oauth.getAccessToken.html) but I still get an error:

oauth_problem=signature_invalid&debug_sbs=GET&http%3A%2F%2Fwww.flickr.com%2Fservices%2Foauth%2Frequest_token&oauth_callback%3D%26oauth_consumer_key%3Da0f20d2c9b0a142848cffdf9d9a5ad78%26oauth_nonce%3DFCBB713F-581E-4BC6-42FF-C50252D839EC%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1330450158%26oauth_version%3D1.0

I don't get how to create that signature nor how to put it in the request, could anybody point me in the right direction? Thanks!

I am currently working with AS3, below is my code:

// request params
var now:Date = new Date();
var requestParams:Object = {};
requestParams.oauth_callback = "";  // there is no callback, it's a desktop application
requestParams.oauth_consumer_key = API_KEY;
requestParams.oauth_nonce = UIDUtil.getUID(now);
requestParams.oauth_timestamp = String(now.time).substring(0, 10);
requestParams.oauth_signature_method = "HMAC-SHA1";
requestParams.oauth_version = "1.0";


// create an array to sort param names alphabetically
// mandatory to create signature 
var sortedRequestParamNames:Array = [];
var name:String;
for(name in requestParams)
{
    sortedRequestParamNames.push(name);
}
sortedRequestParamNames.sort();


// create signature
// see http://www.flickr.com/services/api/auth.spec.html#signing
var oauthSignature:String = API_SECRET;
var i:uint;
var numParams:uint = sortedRequestParamNames.length;
var paramName:String;
for(i = 0; i < numParams; i++)
{
    paramName = sortedRequestParamNames[i];
    oauthSignature += paramName + convertToPercentEntities(requestParams[paramName]);
}
oauthSignature = MD5.hash(oauthSignature);


// build request
var tokenRequestString:String = REQUEST_TOKEN_URL;
for(i = 0; i < numParams; i++)
{
    paramName = sortedRequestParamNames[i];
    tokenRequestString += (i == 0) ? "?" : "&";
    tokenRequestString += paramName + "=" + requestParams[paramName];
}
tokenRequestString += "&oauth_signature=" + oauthSignature;


var tokenRequest:URLRequest = new URLRequest(tokenRequestString);
tokenRequest.method = URLRequestMethod.GET;


// load request
initLoader();
_loader.addEventListener(Event.COMPLETE, requestTokenLoadedHandler);
_loader.load(tokenRequest);

2 Answers 2

4

Basically, you need to use the HMAC-SHA1 algorithm instead of an MD5. I'll walk you through it.

1. Create the signature base string

You seem to be doing that (but you are assigning it directly to the signature variable). Compiling the base string is done by concatenating three different parts.

  1. Convert the HTTP Method to uppercase and set the base string equal to this value. Example: GET
  2. Append the '&' character to the base string.
  3. Percent encode the URL (without parameters) and append it to the base string. Example: http%3A%2F%2Fexample.com%2Frequest
  4. Append the '&' character to the base string.
  5. Percent encode the sorted parameter string and append it to the base string.

It should end up looking like this:

GET&http%3A%2F%2Fexample.com%2Frequest&a2%3Dr%2520b%26a3%3D2%2520q %26a3%3Da%26b5%3D%253D%25253D%26c%2540%3D%26c2%3D%26oauth_consumer_ key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk 9d7dh3k39sj

Now you're done with the signature base string. Lets move on to

2. Figuring out your signing key.

Your signing key is on this format: CONSUMER_SECRET + "&" + TOKEN_SECRET. But since you do not have a token yet, the signing key is the consumer secret and an ampersand. Like this: CONSUMER_SECRET + "&".

For all requests, except the first one your will have a token though, either a request token or an access token.

3. Combine the key and the base string using the HMAC-SHA1 algorithm.

I have used http://code.google.com/p/as3crypto/ when signing with AS3. You can even test its HMAC-SHA1 algorithm on this demo page: http://crypto.hurlant.com/demo/.

Use the base string as input, and the signing key as key to the HMAC-SHA1 algorithm.

The output of the HMAC-SHA1 algorithme will be a binary string which needs to be base64 encoded to produce the final signature. It should look something like this:

NYIQGEwIomgCuVOIA28pMDMID78=

This should be send with the request as the oauth_signature parameter.

1
  • This reply helped me greatly. I would just add depending on language the HMAC-SHA1 conversion must be output in BINARY, rather than hex prior to the base64 encoding.
    – Lomax
    Commented Mar 2, 2017 at 15:01
0

I had problem with it too, ended up using FlickrNet API.

http://flickrnet.codeplex.com/

1
  • flickrnet is a complete mystery to me. I cannot figure out the verifier parameter for getting the authentication token. I'm using WPF so the callback url seems weird...
    – CarllDev
    Commented Mar 8, 2014 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.