What is the correct OAuth code encoding?

Question

I am working on implementing Oauth Api, and I found that there are several things that I experience when checking, I would like someone to be able to give clarifications. Warning I will probably move, so I will try to highlight my questions in bold.

According to the oauth specification 1.0 http://tools.ietf.org/html/rfc5849, I am convinced that the way oauth parameters are percent encoded for signatures is different when on the wire. Section 3.6 http://tools.ietf.org/html/rfc5849#section-3.6 "It is used only when constructing the signature base line and in the" Authorization "header field.

RFC3986 http://tools.ietf.org/html/rfc3986 This is apparently the percentage coding scheme used in regular queries. However, I have not seen it display any 'this' maps for "this", so I assume that the symbol is in a reserved list. The hexadecimal equivalent should be used.

The only difference is that a '' (Space) is% 20 when encoding for signature? The Oauth specification refers to this, but I cannot honestly find where it is defined in other specifications. It would be great if someone could tell me where this is mentioned, and how I might have misunderstood it.

Should other space characters be% 20? Where does the specification mention this?

Is it a regular UrlEncode character for body shape and query parameters?

Finally, I have an example of the output I'm looking for for verification. I tried to show the difference between the Oauth Signature character encoding and the Url encoded character. And again, the only differences are the processing of '', '*' and '~'

Char Oauth Url * %2A * ~ ~ %7E % %25 %25 ! %21 %21 : %3A %3A / %2F %2F = %3D %3D & %26 %26 + %2B %2B %20 + , %2C %2C @ %40 %40 \r\n %0D%0A %0D%0A \n %0A %0A \r %0D %0D " %22 %22 ? %3F %3F ( %28 %28 ) %29 %29 | %7C %7C [ %5B %5B ] %5D %5D 

Answer 1

Although this is an old post, I would like to state my understanding.

As for the percent encoding specified in rfc3986 # 2.1 , we understand that all characters other than undeserved characters are escaped.

This means that in addition to:

  unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" 

The remaining characters must be encoded.

An example implementation in java is provided here . Find the percentEncode method that takes a string as an argument.

 public static String percentEncode(String s) 

Additional code examples in other languages ​​can be found here .

Answer 2

Perhaps this part of the Twitter developer docs can help you: https://developer.twitter.com/en/docs/basics/authentication/guides/percent-encoding-parameters.html

Answer 3

For JavaScript:

 /** * encodeURIComponent(str) Unescaped / Reserved characters: * * Alphabetic, Digit and -_.~!*'() * * oAuth Unescaped / Reserved characters: * * Alphabetic, Digit and -_.~ * */ // Encode with !*'() this.oAuthEncode = function (value) { value = encodeURIComponent(value) value = value.replace(/!/g, '%21') // ! value = value.replace(/\*/g, '%2A') // * value = value.replace(/'/g, '%27') // ' value = value.replace(/\)/g, '%29') // ) value = value.replace(/\(/g, '%28') // ( return value; }; // Decode with !*'() this.oAuthDecode = function (value) { value = decodeURIComponent(value) value = value.replace(/%21/g, '!') // ! value = value.replace(/%2A/g, '*') // * value = value.replace(/%27/g, '\'') // ' value = value.replace(/%29/g, ')') // ) value = value.replace(/%28/g, '(') // ( return value; };