OAuth 1.0 Authentication from .net core 6.0 rest api always responds Invalid Signature

112 Views Asked by At

I am trying to call a third-party api from my .net core 6.0 rest api using OAuth 1.0 authentication. I have prepared the Signature base string as per OAuth 1.0 documentation and the Signature key using Consumer Secret and Token Secret, but it always respond in 401 status code with message saying "The supplied authentication is invalid: Invalid signature".

I am using the following code:

var timeStamp = ((int)(DateTime.UtcNow - new DateTime(1970, 1, 1)).TotalSeconds).ToString();
var nonce = Convert.ToBase64String(Encoding.UTF8.GetBytes(timeStamp));

var sb = new StringBuilder();
sb.Append(url.ToLower());
sb.Append("&" + "oauth_consumer_key=" + _tradeShiftConfigurations.ConsumerKey);
sb.Append("&" + "oauth_token=" + _tradeShiftConfigurations.Token);
sb.Append("&" + "oauth_signature_method=" + "HMAC-SHA1");
sb.Append("&" + "oauth_timestamp=" + timeStamp);
sb.Append("&" + "oauth_nonce=" + nonce);
sb.Append("&" + "oauth_version=1.0");
var signatureBase=  Uri.EscapeDataString(sb.ToString());

var signatureKey = string.Format("{0}&{1}", Uri.EscapeDataString(ConsumerSecret), Uri.EscapeDataString(TokenSecret));
var hmac = new HMACSHA1(Encoding.UTF8.GetBytes(Uri.EscapeDataString(signatureKey)));
var signatureBaseBytes = Encoding.UTF8.GetBytes(signatureBase);
var signature = Convert.ToBase64String(hmac.ComputeHash(signatureBaseBytes));

signature = Uri.EscapeDataString(signature);`
1

There are 1 best solutions below

0
Naveen Negi On

I was able to connect the Api having OAuth 1.0 authentication using a Nuget package OAuth.DotNetCore. I used following code to connect the api:

var url = "API URL HERE";
OAuthRequest client = new()
{
    Method = "GET",
    Type = OAuthRequestType.ProtectedResource,
    SignatureMethod = OAuthSignatureMethod.HmacSha1,
    ConsumerKey = ConsumerKey,
    ConsumerSecret = ConsumerSecret,
    Token = Uri.EscapeDataString(Token),
    TokenSecret = Uri.EscapeDataString(TokenSecret),
    Version = "1.0",
    Realm = url,
    RequestUrl = url
};
string auth = client.GetAuthorizationHeader();
var request = new HttpRequestMessage(HttpMethod.Get, url);
request.Headers.Add("Authorization", auth);
request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
var response = await _httpClient.SendAsync(request).ConfigureAwait(false);