Dart OAuth 1.0 - 无效签名 - 提供的签名不匹配

Question

我正在使用 OAuth 1.0 调用 api，并且使用以下包进行 api 调用。但我收到以下错误。请任何人指导我修复这个错误。

api调用库：

https://github.com/nbspou/dart-oauth1

我的代码：

const String apiKey = 'ck_789b63aee985c4569bfa5ae4724861ae5c74c337';
  const String apiSecret = 'cs_0f0addbc9c16042d5689a4cfe6fbfd209b00d55b';
  var clientCredentials = new oauth1.ClientCredentials(Uri.encodeComponent(apiKey), Uri.encodeComponent(apiSecret));

  // create Authorization object with client credentials and platform definition
  //var auth = new oauth1.Authorization(clientCredentials, platform);
  var auth = new oauth1.Credentials(apiKey, apiSecret);
  // yeah, you got token credentials
  // create Client object
  var client = new oauth1.Client(platform.signatureMethod, clientCredentials, auth);

  // now you can access to protected resources via client
  client.get('http://demo2.signitydemo.in/foodemporium/wp-json/wc/v3/products/categories').then((res) {
    print("res.body===${res.body}");
    print("statusCode===${res.statusCode}");
    print("headers===${res.headers}");

  });




{"code":"woocommerce_rest_authentication_error","message":"Invalid signature - provided signature does not match.","data":{"status":401}}

标题：

{link: <http://demo2.signitydemo.in/foodemporium/wp-json/>; rel="https://api.w.org/", access-control-allow-headers: Authorization, Content-Type, connection: keep-alive, date: Fri, 03 Jul 2020 05:32:04 GMT, transfer-encoding: chunked, vary: Origin, access-control-expose-headers: X-WP-Total, X-WP-TotalPages, x-robots-tag: noindex, content-type: application/json; charset=UTF-8, x-content-type-options: nosniff, server: nginx}

我已经在Postman中测试了API。工作正常，我正在收到回复。请参阅下面的邮递员 API 请求。

Answer 1

所以我放弃了 Woocommerce 包来创建一个函数，使用新参数解析 url 以进行 oauth 1.0 身份验证

import 'dart:collection';
import 'dart:math';
import 'package:crypto/crypto.dart' as crypto;
import 'package:http/http.dart' as http;
import 'dart:convert';

/// This Generates a valid OAuth 1.0 URL
///
/// if [isHttps] is true we just return the URL with
/// [consumerKey] and [consumerSecret] as query parameters
String _getOAuthURL(String requestMethod, String queryUrl) {
      String consumerKey = cKey;
      String consumerSecret = cSecret;

    String token = "";
    String url = queryUrl;
    bool containsQueryParams = url.contains("?");

    Random rand = Random();
    List<int> codeUnits = List.generate(10, (index) {
      return rand.nextInt(26) + 97;
    });

    /// Random string uniquely generated to identify each signed request
    String nonce = String.fromCharCodes(codeUnits);

    /// The timestamp allows the Service Provider to only keep nonce values for a limited time
    int timestamp = DateTime.now().millisecondsSinceEpoch ~/ 1000;

    String parameters = "oauth_consumer_key=" +
        consumerKey +
        "&oauth_nonce=" +
        nonce +
        "&oauth_signature_method=HMAC-SHA1&oauth_timestamp=" +
        timestamp.toString() +
        "&oauth_token=" +
        token +
        "&oauth_version=1.0&";

    if (containsQueryParams == true) {
      parameters = parameters + url.split("?")[1];
    } else {
      parameters = parameters.substring(0, parameters.length - 1);
    }

    Map<dynamic, dynamic> params = QueryString.parse(parameters);
    Map<dynamic, dynamic> treeMap = new SplayTreeMap<dynamic, dynamic>();
    treeMap.addAll(params);

    String parameterString = "";

    for (var key in treeMap.keys) {
      parameterString = parameterString +
          Uri.encodeQueryComponent(key) +
          "=" +
          treeMap[key] +
          "&";
    }

    parameterString = parameterString.substring(0, parameterString.length - 1);

    String method = requestMethod;
    String baseString = method +
        "&" +
        Uri.encodeQueryComponent(
            containsQueryParams == true ? url.split("?")[0] : url) +
        "&" +
        Uri.encodeQueryComponent(parameterString);

    String signingKey = consumerSecret + "&" + token;
    crypto.Hmac hmacSha1 =
        crypto.Hmac(crypto.sha1, utf8.encode(signingKey)); // HMAC-SHA1

    /// The Signature is used by the server to verify the
    /// authenticity of the request and prevent unauthorized access.
    /// Here we use HMAC-SHA1 method.
    crypto.Digest signature = hmacSha1.convert(utf8.encode(baseString));

    String finalSignature = base64Encode(signature.bytes);

    String requestUrl = "";

    if (containsQueryParams == true) {
      requestUrl = url.split("?")[0] +
          "?" +
          parameterString +
          "&oauth_signature=" +
          Uri.encodeQueryComponent(finalSignature);
    } else {
      requestUrl = url +
          "?" +
          parameterString +
          "&oauth_signature=" +
          Uri.encodeQueryComponent(finalSignature);
    }

    return requestUrl;
  }

通过上面的这个函数，我可以在异步函数中发出请求，如下所示：

Future fetchWooProducts() async {
    http.Response response = await http.get(_getOAuthURL("GET", '$productsUrl'),
         headers: {"Content-Type": "Application/json"});//using JWT token for WP authentication is not needed
    print(response.body);
}

Answer 2

和 QueryString 类类似

class QueryString {
/// Parses the given query string into a Map.
static Map parse(String query) {
var search = new RegExp('([^&=]+)=?([^&]*)');
var result = new Map();

// Get rid off the beginning ? in query strings.
if (query.startsWith('?')) query = query.substring(1);

// A custom decoder.
decode(String s) => Uri.decodeComponent(s.replaceAll('+', ' '));

// Go through all the matches and build the result map.
for (Match match in search.allMatches(query)) {
  result[decode(match.group(1))] = decode(match.group(2));
}

return result;
}

Answer 3

非常感谢，它对我有用！