> Hello,

> I'm trying to use the JavaScript API to authenticate with OAuth from a
> GWT application. I've got it working with both Google and Twitter's
> OAuth implementations. However, it seems to fail to sign the URL at
> random. In other words, it works 1 out of 3 times.

> I'm using the following makeSignedRequest() function to create the
> signed URL.

> Fromhttp://paul.donnelly.org/2008/10/31/2-legged-oauth-javascript-functio...

> <script type="text/javascript">
>         var makeSignedRequest = function(ck, cks, ts, encodedurl) {
>             var accessor = { consumerSecret: cks, tokenSecret: ts};
>             var message = { action: encodedurl, method: "GET",
> parameters: [
>                 ["oauth_version","1.0"],
>                 ["oauth_consumer_key",ck]
>             ]};

>             OAuth.setTimestampAndNonce(message);
>             OAuth.SignatureMethod.sign(message, accessor);

>             var parameterMap = OAuth.getParameterMap(message);
>             var baseStr = OAuth.decodeForm
> (OAuth.SignatureMethod.getBaseString(message));
>             var theSig = "";

>             if (parameterMap.parameters) {
>                 for (var item in parameterMap.parameters) {
>                     for (var subitem in parameterMap.parameters[item])
> {
>                         if (parameterMap.parameters[item][subitem] ==
> "oauth_signature") {
>                             theSig = parameterMap.parameters[item][1];
>                             break;
>                         }
>                     }
>                 }
>             }

>             var paramList = baseStr[2][0].split("&");
>             paramList.push("oauth_signature=" + theSig);
>             paramList.sort(function(a, b) {
>                 if (a[0] < b[0]) return -1;
>                 if (a[0] > b[0]) return 1;
>                 if (a[1] < b[1]) return  -1;
>                 if (a[1] > b[1]) return 1;
>                 return 0;
>             });

>             var locString = "";
>             for (var x in paramList) {
>                 locString += paramList[x] + "&";
>             }

>             return baseStr[1][0] + "?" + locString.slice(0,
> locString.length - 1);
>         };

>     </script>

> Any idea why this could be happening?

> Thanks,

> Matt

> Hey Matt, try the code below. It works reliably for me.

> Make sure you've included:http://oauth.googlecode.com/svn/code/javascript/oauth.jshttp://oauth....
> <script type="text/javascript">
>         var requestUrl = 'http://...';
>         var ck = '...';
>         var cks = '...';
>         var accessor = {consumerSecret: cks};
>         var message = {
>             method: "GET",
>             action: requestUrl,
>             parameters: [
>                 ['oauth_signature_method', 'HMAC-SHA1'],
>                 ['oauth_consumer_key', ck],
>                 ['oauth_version', '1.0'],
>                 ['xoauth_requestor_id', guid],
>                 ['format', 'json']
>             ]
>         };

>         OAuth.setTimestampAndNonce(message);
>         OAuth.setParameter(message, "oauth_timestamp", OAuth.timestamp
> ());
>         OAuth.SignatureMethod.sign(message, accessor);
>         var finalUrl = OAuth.addToURL(message.action,
> message.parameters);
> </script>

> On Jun 17, 8:28 am, Matt Raible <mrai...@gmail.com> wrote:

> > Hello,

> > I'm trying to use the JavaScript API to authenticate with OAuth from a
> > GWT application. I've got it working with both Google and Twitter's
> > OAuth implementations. However, it seems to fail to sign the URL at
> > random. In other words, it works 1 out of 3 times.

> > I'm using the following makeSignedRequest() function to create the
> > signed URL.

> > Fromhttp://paul.donnelly.org/2008/10/31/2-legged-oauth-javascript-functio...

> > <script type="text/javascript">
> >         var makeSignedRequest = function(ck, cks, ts, encodedurl) {
> >             var accessor = { consumerSecret: cks, tokenSecret: ts};
> >             var message = { action: encodedurl, method: "GET",
> > parameters: [
> >                 ["oauth_version","1.0"],
> >                 ["oauth_consumer_key",ck]
> >             ]};

> >             OAuth.setTimestampAndNonce(message);
> >             OAuth.SignatureMethod.sign(message, accessor);

> >             var parameterMap = OAuth.getParameterMap(message);
> >             var baseStr = OAuth.decodeForm
> > (OAuth.SignatureMethod.getBaseString(message));
> >             var theSig = "";

> >             if (parameterMap.parameters) {
> >                 for (var item in parameterMap.parameters) {
> >                     for (var subitem in parameterMap.parameters[item])
> > {
> >                         if (parameterMap.parameters[item][subitem] ==
> > "oauth_signature") {
> >                             theSig = parameterMap.parameters[item][1];
> >                             break;
> >                         }
> >                     }
> >                 }
> >             }

> >             var paramList = baseStr[2][0].split("&");
> >             paramList.push("oauth_signature=" + theSig);
> >             paramList.sort(function(a, b) {
> >                 if (a[0] < b[0]) return -1;
> >                 if (a[0] > b[0]) return 1;
> >                 if (a[1] < b[1]) return  -1;
> >                 if (a[1] > b[1]) return 1;
> >                 return 0;
> >             });

> >             var locString = "";
> >             for (var x in paramList) {
> >                 locString += paramList[x] + "&";
> >             }

> >             return baseStr[1][0] + "?" + locString.slice(0,
> > locString.length - 1);
> >         };

> >     </script>

> > Any idea why this could be happening?

> > Thanks,

> > Matt

> ... Looking
> at both Paul Donnelly's and yours, neither contains the "tokenSecret"
> in the accessor that's used to sign the access_token request, as well
> as any API requests. Am I correct in assuming that the tokenSecret
> (the "auth_token_secret" value returned after getting the initial
> token) is needed for these two calls?

> To be clear, I can reliably get a token and authorize it. After that,
> it seems like getting an access_token works 50% of the time and
> calling the api (with auth_token as a param in the URL) works 30% of
> the time.

> I'm trying to use the JavaScript API to authenticate with OAuth from a
> GWT application. I've got it working with both Google and Twitter's
> OAuth implementations.

On Sat, Jun 20, 2009 at 4:22 PM, John Kristian<jmkrist...@gmail.com> wrote:

> Can a GWT application communicate cross-domain, with an OAuth service
> provider other than the GWT application server?  How?  I've read that
> browser security restrictions prevent this.
> http://www.mooreds.com/wordpress/archives/000500

> On Jun 17, 8:28 am, Matt Raible <mrai...@gmail.com> wrote:
>> I'm trying to use the JavaScript API to authenticate with OAuth from a
>> GWT application. I've got it working with both Google and Twitter's
>> OAuth implementations.