Network Error: 204 ("Response error: "Failed to validate oauth signature and token")

[pga]

Hi all,

I develop an application for Symbian platform in Qt. I have
encountered a problem when trying to pass xAuth using QTweetLib
library. I have both consumer key and secret. I just got conformation
from Twitter API Policy guys that I should be able to pass xAuth using
these credentials (I have permission) but I'm not.

Here is the snippet of code:
m_oauthTwitter = new OAuthTwitter(a_netManager, this);
connect(m_oauthTwitter, SIGNAL(authorizeXAuthFinished()),
SLOT(xauthFinished()));
connect(m_oauthTwitter, SIGNAL(authorizeXAuthError()),
SLOT(xauthError()));
…
m_oauthTwitter->authorizeXAuth(username, password); // username and
password are OK

I got following error (from application's output console – Qt Creator
IDE):
OAuth tokens are empty!
Network Error: 204
Response error: "Failed to validate oauth signature and token"

The error occurs on both real device (Nokia N8) and simulator (Windows
XP). Date/Time seem to be set correctly.

Could you advice me what should I try to solve the problem?

Best Regards,
Pawel

[Taylor Singletary]

Hi Pawel,

OAuth problems tend to require digging a bit deeper than surface error messages to debug -- to help you in this case, we would need to know at minimum: the HTTP Authorization header used in your request, the format of the POST body you are sending (but not the actual usernames and passwords), and the exact URL you are accessing -- all details that the library you are using likely make difficult, but not impossible, to ascertain. The signature base string is also extremely useful for debugging, but also requires you to filter out details of usernames and passwords.

In most cases a problem like this is due to a parameter encoding error or by a request with POST bodies and signature base strings not in agreement.

@episod - Taylor Singletary

--
Twitter developer documentation and resources: http://dev.twitter.com/doc
API updates via Twitter: http://twitter.com/twitterapi
Issues/Enhancements Tracker: http://code.google.com/p/twitter-api/issues/list
Change your membership to this group: http://groups.google.com/group/twitter-development-talk

[pga]

Hi Taylor,

Thank you for your input. Here are details:

1. Additional sources:
void OAuthTwitter::authorizeXAuth(const QString &username, const
QString &password)
{
Q_ASSERT(m_netManager != 0);

QUrl url(TWITTER_ACCESS_TOKEN_XAUTH_URL);
url.addQueryItem("x_auth_username", username);
url.addQueryItem("x_auth_password", password);
url.addQueryItem("x_auth_mode", "client_auth");

QByteArray oauthHeader = generateAuthorizationHeader(url,
OAuth::POST);

QNetworkRequest req(url);
req.setRawHeader(AUTH_HEADER, oauthHeader);

QNetworkReply *reply = m_netManager->post(req, QByteArray());
connect(reply, SIGNAL(finished()), this,
SLOT(finishedAuthorization()));
}

2. HTTP request:
POST

3. Url (content of 'url' object):
https://api.twitter.com/oauth/access_token?x_auth_username=myn...@o2.pl&x_auth_password=mypassword&x_auth_mode=client_auth

4. Authorization header (content of 'oauthHeader' object):
OAuth oauth_consumer_key="myconsumerkey",oauth_signature_method="HMAC-
SHA1",oauth_signature="kqb27IFO2BM3iEO4fhfYK%2BbTc3Y
%3D",oauth_timestamp="1304491190",oauth_nonce="3uLG1a72zvcGdyJr",oauth_version="1.0"

5. Body:
none (empty)

6. Additional observations:
When I type username instead of e-mail (currently I use e-mail and
password to login to Twitter) then xAuth pass successfully but only on
the simulator and only first time... Reproducibility 100%.

Best Regarrds,
Pawel

On 2 Maj, 16:56, Taylor Singletary <taylorsinglet...@twitter.com>
wrote:

> Hi Pawel,
>
> OAuth problems tend to require digging a bit deeper than surface error
> messages to debug -- to help you in this case, we would need to know at
> minimum: the HTTP Authorization header used in your request, the format of
> the POST body you are sending (but not the actual usernames and passwords),
> and the exact URL you are accessing -- all details that the library you are
> using likely make difficult, but not impossible, to ascertain. The signature
> base string is also extremely useful for debugging, but also requires you to
> filter out details of usernames and passwords.
>
> In most cases a problem like this is due to a parameter encoding error or by
> a request with POST bodies and signature base strings not in agreement.
>

> @episod <http://twitter.com/episod> - Taylor Singletary

[pga]

SOLVED. On simulator it was working well but device had set incorrect
date/time.