{"issue":{"created_at":"2011-11-21T20:44:55Z","state":"open","updated_at":"2011-11-24T20:40:36Z","comments":7,"user":{"gravatar_id":"deb0bae7346068df73897b83a7a77ee7","id":298100,"url":"https://api.github.com/users/joelclermont","login":"joelclermont","avatar_url":"https://secure.gravatar.com/avatar/deb0bae7346068df73897b83a7a77ee7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"body":"When generating a signature block, all request parameters should be decoded, normalized, encoded, concatenated and then encoded again.\r\n\r\nFor example, take the following parameter collection (already decoded and normalized):\r\n\r\n`oauth_consumer_key = tA3CzsVG2dr2WiC4HxwU49t4fkoRbXC2\r\noauth_token = 3oorxi5fm5iWTqCKxC4Xz9rt5sXw5yWo\r\noauth_nonce = 30mx65tsg7hi1wvd\r\noauth_timestamp = 1321906028\r\noauth_signature_method = HMAC-SHA1\r\noauth_version =1.0\r\nparameters[owned_by] = me`\r\n\r\nThe next step should produce a parameter collection which looks like this:\r\n\r\n`oauth_consumer_key=tA3CzsVG2dr2WiC4HxwU49t4fkoRbXC2&oauth_nonce=30mx65tsg7hi1wvd&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1321906028&oauth_token=3oorxi5fm5iWTqCKxC4Xz9rt5sXw5yWo&oauth_version=1.0&parameters%5Bowned_by%5D=me`\r\n\r\n(Note that the [ and ] characters in the final parameter name were encoded)\r\n\r\nThis encoded parameter collection should then be encoded again as a whole and appended to the HTTP method and URL. It would look something like this:\r\n\r\n`GET&http%3A%2F%2Fwww.h2oscore.com%2Fapi%2Fv1%2Faddress&oauth_consumer_key%3DtA3CzsVG2dr2WiC4HxwU49t4fkoRbXC2%26oauth_nonce%3D30mx65tsg7hi1wvd%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1321906028%26oauth_token%3D3oorxi5fm5iWTqCKxC4Xz9rt5sXw5yWo%26oauth_version%3D1.0%26parameters%255Bowned_by%255D%3Dme`\r\n\r\nThe part of that block which I am drawing attention to is at the end: `parameters%255Bowned_by%255D%3Dme`\r\n\r\nWithout this pull request, it instead generates: `parameters%5Bowned_by%5D%3Dme`\r\n\r\nThis will cause the OAuth request to be invalid, as the signature will not match what the server is expecting.\r\n\r\nRegarding my particular fix, I'm not sure if this is the best way. I made a modification to your CollectionExtensions.Concatenate function. Internally, I'm encoding the Key and Value (using your existing static method). As far as I can tell, this particular function isn't used anywhere else in Hammock, but if it was (or if you wanted to in the future), this may not be an appropriate place to path the encoding bug.\r\n\r\nReferences: \r\nhttp://hueniverse.com/oauth/guide/authentication/\r\nhttp://tools.ietf.org/html/rfc5849#section-3.4.1.3","assignee":null,"labels":[],"id":2309147,"pull_request":{"patch_url":"https://github.com/danielcrenna/hammock/pull/52.patch","html_url":"https://github.com/danielcrenna/hammock/pull/52","diff_url":"https://github.com/danielcrenna/hammock/pull/52.diff"},"number":52,"title":"parameters need to be encoded in two passes","closed_at":null,"html_url":"https://github.com/danielcrenna/hammock/issues/52","milestone":null,"url":"https://api.github.com/repos/danielcrenna/hammock/issues/52"},"action":"created","comment":{"created_at":"2011-11-24T20:40:36Z","updated_at":"2011-11-24T20:40:36Z","user":{"gravatar_id":"684676c4ec78fa88144b5256dd880986","id":129610,"url":"https://api.github.com/users/danielcrenna","login":"danielcrenna","avatar_url":"https://secure.gravatar.com/avatar/684676c4ec78fa88144b5256dd880986?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"body":"I'm at the same loss as you. I know that in practice, yes, Twitter deviates from the spec in this regard as I experienced issues trying to use Hammock (from where this code came) against the Google APIs. I don't know if it's been captured as an issue on the Twitter development list or if anyone has had to work around this officially. I don't have time to look into things during the week but I might be able to help out this weekend.","id":2869021,"url":"https://api.github.com/repos/danielcrenna/hammock/issues/comments/2869021"}}