How properly create oauth signature base string? - c++

Question

I want to implement OAuth 1.0 protocol in order to work with COPY. But when i implemented OAuth protocol in C++ in order to get Request Token and sent that request to copy it's return that signature is invalid and i can't figure out what's wrong in my signature. Here are all parameters that i generate by my program:
oauth_nonce=xoviybpokqnxdwlnkeoorawfijgezr
oauth_timestamp=1381745375
oauth_callback=http%3A%2F%2Fcopy-oauth.local%2Fget_access_token.php
oauth_signature_method=HMAC-SHA1
This is base string that i used in order to generate token:
GET&https%3A%2F%2Fapi.copy.com%2Foauth%2Frequest&oauth_consumer_key%3D[my
32 symbols
key]%26oauth_nonce%3Dxoviybpokqnxdwlnkeoorawfijgezr%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1381745375%26oauth_tokey%3D
It's key for generating signature:
[My consumer secret, 48 symbols]&
Here is signature that i received after base64 and percent encoded:
lNaaOaWyGtkJWj%2BVLjLlKTVGYL0%3D
And the last thing is sending all parameters to server. For this purpose i use libcurl:
char * abc="https://api.copy.com/oauth/request/?oauth_callback=http%3A%2F%2Fcopy-oauth.local%2Fget_access_token.php&oauth_consumer_key=[my 32 symbols key]&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1381745375&oauth_nonce=xoviybpokqnxdwlnkeoorawfijgezr&oauth_signature=lNaaOaWyGtkJWj%2BVLjLlKTVGYL0%3D";
CURL *curl;
CURLcode res;
curl_global_init(CURL_GLOBAL_DEFAULT);
curl = curl_easy_init();
if(curl)
{
curl_easy_setopt (curl, CURLOPT_SSL_VERIFYPEER, TRUE);
curl_easy_setopt(curl, CURLOPT_CAINFO, "C:\\a\\a\\a\\cacert.pem");
curl_easy_setopt(curl, CURLOPT_URL, abc);
res = curl_easy_perform(curl);
/* Check for errors */
if(res != CURLE_OK)
fprintf(stderr, "curl_easy_perform() failed: %s\n",
curl_easy_strerror(res));
/* always cleanup */
curl_easy_cleanup(curl);
}
curl_global_cleanup();
Then my console will output:
oauth_error_message=oauth_problem%3Dsignature_invalid%26debug_sbs...
What's wrong in my implementation?

Answer 1

The main problem was that oauth_callback should be two time percent encoded in order to create signature base string. This is string that I send in request:
oauth_callback="http://copy-oauth.local/get_access_token.php"
And this is string that I add to signature base string:
http%253A%252F%252Fcopy-oauth.local%252Fget_access_token.php

Answer 2

Here are a few things that immediately spring to mind:
Your signature base string should include the oauth_callback parameter
oauth_token should not be included in the signature base string as you are not including it in your querystring parameters
The path of your url should not end in a forward slash unless you also include for this in your signature base string:
char * abc="https://api.copy.com/oauth/request?oauth_callback= ...
You should remove the '&' character from the end of your querystring