Search code examples
htmlruby-on-railsoauthauthorizationoauth-1.0a

Which params does an OAuth 1.0 server look at?

I'm using OAuth 1.0 to sign requests i'm sending via http POST.

My question is, does the server that receives the payload generate the signature based on ALL the fields sent in the form, or only ones it cares about?

I'm using a web framework that inserts some extra fields for its own purpose, and i wondered if these could be interfering with the OAuth signature generation process on the server?

Solution

  • The spec says that all params (post and get) are used in generating the oauth_signature. So, I guess they are interfering with the signature process. But, if they are added and accounted in generating the signature, then it should be OK.