> I've added a nonce to the HMAC signature. In the next week or so, I'll
> try to update the documentation on the wiki on the changes to HMAC
> signatures.

> Next up is allowing more flexibility in parameters for exposed methods
> (probably default values).

> Cash

> On Nov 9, 9:03 pm, Cash Costello <cash.coste...@gmail.com> wrote:

> > The next big update is done on the web services API. Changes include

> > 1. hmac should now be compatible with Amazone S3 and OAuth - will
> > probably add a nonce
> > 2. users won't be logged out now
> > 3. cut out the extraneous wrapper of json output
> > 4. centralized web services handler - this is the biggest change

> > The rest api is now hit at /services/api/rest/xml/?method=test

> > You can now replace the default rest handler with your own.
> > You can add additional web services. ex: /services/api/soap/xml for
> > example

> > I whipped up a quick example where I registered a "web service" called
> > docs that provided full documentation on each registered function /
> > services/api/doc/?method=test

> > Please note that you will need to update your .htaccess file for this
> > to work.

> > Cash

> > On Oct 25, 4:20 pm, Cash Costello <cash.coste...@gmail.com> wrote:

> > > The current Elgg REST API is not really RESTful but more of a REST/RPC
> > > hybrid approach (similar to Twitter, Facebook, Flickr). It is not
> > > structured well to handle more than GET/POST in a nontrivial fashion.
> > > As such, I think I'm going to stick with the current GET/POST
> > > restrictions. Any comments?

> > > On Oct 23, 8:30 am, Cash Costello <cash.coste...@gmail.com> wrote:

> > > > I've used php and java with the current hmac without any problems (and
> > > > I did not write it). I'm going to look into making it compatible with
> > > > OAuth:http://oauth.net/core/1.0#anchor16

> > > > I've add a simple api auth method that just requires the public key.
> > > > This is probably sufficient for using the API to integrate
> > > > applications and for a lot of external facing uses, too.

> > > > I noticed from your client that you are using more than GET and POST.
> > > > That's also something that I've kicked around but wasn't sure anyone
> > > > would use it.

> > > > On Oct 23, 7:15 am, milan <mi...@magudia.com> wrote:

> > > > > 1) Yes - I think we are, but not open sourced api's

> > > > > 2) Created elgg based web services

> > > > > 3) See 4!

> > > > > 4) We're using the HMAC signatures or to be accurate we tried to use
> > > > > them and found them to not be compatible with other tool sets and
> > > > > languages. The problem I think was that the HMAC was calculated into
> > > > > hex values and not encoded into a standard canonicalized format which
> > > > > doesn't change across toolkits.

> > > > > a) The actually format of the string to sign wasn't normalised to
> > > > > UTF-8 (not normally an issue, but can be)
> > > > > b) The hmac isn't generated using binary values (see:http://php.net/manual/en/function.hash-hmac.php)
> > > > > c) If the hmac is in binary then the output of this can be base64
> > > > > encoded into a standard strict format, which is built into nearly
> > > > > every language by default (apart from *cough* java where you need a
> > > > > external jar).

> > > > > Why do this? As other languages by default out put binary values from
> > > > > the HMAC and also the hex output is generally unpredictably different.

> > > > > I have an example client here:http://www.hedgehogs.net/mod/studios/client/php/

> > > > > We also did away with doing different Hashes for POST and GET.
> > > > > Basically we had a look at the Amz S3 model and then overloaded the
> > > > > current API - I think.

> > > > > As for 5) and 6), i'll ask Sammy as he done more API work than I have!

> > > > > Milan

> > > > > On Oct 22, 2:40 pm, Cash Costello <cash.coste...@gmail.com> wrote:

> > > > > > Hi, Antoine

> > > > > > If you're just starting out, I recommend grabbing the latest REST api
> > > > > > from svn because it has a lot of bug fixes. The files you need are:

> > > > > > /engine/lib/api.php
> > > > > > /engine/lib/pam.php
> > > > > > /engine/lib/xml.php
> > > > > > /languages/en.php (error messages)
> > > > > > /services/api/rest.php

> > > > > > Note that api.php has a hook into Elgg's new unit testing framework
> > > > > > but you won't be able to use that without grabbing more files from
> > > > > > svn. Also, currently the schema in SVN has a bug which breaks the
> > > > > > activity river.

> > > > > > Cash

> > > > > > On Oct 22, 5:49 am, Ant- <antoine.raba...@gmail.com> wrote:

> > > > > > > Hi Cash and everybody.
> > > > > > > to answer your survey:

> > > > > > > 1) No but it's a project

> > > > > > > 2) iPhone and adroid application

> > > > > > > 3) not yet but I will implement it

> > > > > > > 4) just setting that up right now :)- Zitierten Text ausblenden -

> - Zitierten Text anzeigen -