Trouble making OAuth signed requests

Question

Hello,

I am able to successfully make non-authenticated and protected calls to the Netflix API. I am having a little trouble making signed requests to the catalog, however. Using the OAuth Test page, it is clear to me that my Base String is correct. My request URL is also correct, except for the oauth_signature. The oauth_signature is the only thing that differs.

If I understand correctly, the only difference between a protected call and a signed call is that there are no tokens involved, and that I am appending on call parameters (such as term).

So, I am using the exact same code that I use for my protected calls that I am for my signed calls, except my signature key ONLY contains my shared secret (with an ampersand sign on the end of it). It does not use the access token.

Am I missing something here? Where else can I be going wrong?

Thanks!

---

BUILD REQUEST URL:

public static String search2(String term) {
        String url = Const.CATALOG_URL2;
        String header = nfOAuth.AuthSearch(url, "GET", term);

        String searchUrl2 = nfOAuth.concatURL(url, header);

        return searchUrl2;
    }

METHOD TO CONSTRUCT BASE STRING:

public static String AuthSearch(String url, String method, String term) {
        String nonce = nonce();
        String timestamp = timestamp();
        Hashtable pairs = new Hashtable();

        pairs.put(Const.OAUTH_CONSUMER_KEY, Const.consumerKey);
        pairs.put(Const.OAUTH_NONCE, nonce);
        pairs.put(Const.OAUTH_SIGNATURE_METHOD, Const.SIGNATURE_METHOD);
        pairs.put(Const.OAUTH_TIMESTAMP, timestamp);
        pairs.put(Const.OAUTH_VERSION, "1.0");
        pairs.put("term", term);

        String sig = signature2(method, url, pairs);

        StringBuffer header_sb = new StringBuffer();
        if (method.equals("GET")) {
            header_sb.append(Const.OAUTH_CONSUMER_KEY).append("=").append(
                    URLUTF8Encoder.encode(Const.consumerKey)).append(",");
            header_sb.append(Const.OAUTH_NONCE).append("=").append(nonce)
                    .append(",");
            header_sb.append(Const.OAUTH_SIGNATURE).append("=").append(
                    URLUTF8Encoder.encode(sig)).append(",");
            header_sb.append(Const.OAUTH_SIGNATURE_METHOD).append("=").append(
                    URLUTF8Encoder.encode(Const.SIGNATURE_METHOD)).append(",");
            header_sb.append(Const.OAUTH_TIMESTAMP).append("=").append(
                    timestamp).append(",");
            header_sb.append(Const.OAUTH_VERSION).append("=").append("1.0")
                    .append(",");
            header_sb.append("term").append("=").append(
                    URLUTF8Encoder.encode(term));
        }

        System.out.println("HEADER : " + header_sb.toString());
        return header_sb.toString();

    }

SIGNATURE METHOD:

private static String signature2(String method, String requestURL,
            Hashtable pairs) {
        StringBuffer sb = new StringBuffer();
        String[] keys = new String[pairs.size()];
        Enumeration e = pairs.keys();
        int i = 0;

        while (e.hasMoreElements()) {
            String k = (String) e.nextElement();
            keys[i++] = k + "=" + URLUTF8Encoder.encode((String) pairs.get(k));
        }
        Arrays.sort(keys, new Comparator() {
            public int compare(Object arg0, Object arg1) {
                return ((String) arg0).compareTo((String) arg1);
            }
        });
        for (i = 0; i < keys.length; i++) {
            sb.append(keys[i]).append('&');
        }
        sb.deleteCharAt(sb.length() - 1);
        String msg = method.toUpperCase() + "&"
                + URLUTF8Encoder.encode(requestURL) + "&"
                + URLUTF8Encoder.encode(sb.toString());
        System.out.println("MESSAGE: " + msg);

        StringBuffer key = new StringBuffer();
        if (Const.consumerSecret != null)
            key.append(URLUTF8Encoder.encode(Const.consumerSecret));
        key.append('&');

        System.out.println("KEY: " + key.toString()); 

        try {
            return hmacsha1(key.toString(), msg);
        } catch (Exception ex) {
            return null;
        }
    }

Answer 1

It's hard to find the bug without source code. Can you post some sample code?