Java Oauth request_token 流程示例，没有库

Question

我有这段代码：

String yourUrl = "https://api.discogs.com/oauth/request_token";
        String currentSeconds = String.valueOf(System.currentTimeMillis() / 1000);
        String urlString = yourUrl + "?oauth_consumer_key=BaeIqWMTmCxjeJjwmkJr&oauth_nonce=random_string_or_timestamp&oauth_timestamp="+ currentSeconds + "&oauth_callback=http://localhost:8080&oauth_signature=ZWglyBtJasnJBqVnzyduYJggCduKeYks;

        System.out.println(urlString);

        URL url = new URL(urlString);
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setDoOutput(true);
        conn.setRequestMethod("GET");
        conn.setRequestProperty("User-Agent", "test");

        int statusCode = conn.getResponseCode();

但是我有这个错误：

Status Code: 401
Invalid signature. Expected signature base string: ZWglyBtJasnJBqVnzyduYJggCduKeYks&

Answer 1

根据 discogs oauth 流程，您不应将参数作为请求参数发送，而应该将其组合发送到授权 header 中并执行如下操作：

        String yourUrl = "https://api.discogs.com/oauth/request_token";
        String currentSeconds = String.valueOf(System.currentTimeMillis() / 1000);
        URL url = new URL(yourUrl);
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setDoOutput(true);
        conn.setRequestMethod("GET");
        conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
        conn.setRequestProperty("User-Agent", "test");
        conn.setRequestProperty("Authorization",
            "OAuth oauth_consumer_key=\"BaeIqWMTmCxjeJjwmkJr\"," +
                "oauth_nonce=\"" + System.currentTimeMillis() + "\"," +
                "oauth_signature=\"ZWglyBtJasnJBqVnzyduYJggCduKeYks&\"," +
                "oauth_signature_method=\"PLAINTEXT\"," +
                "oauth_timestamp=\"" + currentSeconds + "\"," +
                "oauth_callback=\"your_callback\""
        );

        int statusCode = conn.getResponseCode();

Java Oauth request_token 流程示例，没有库

Java Oauth request_token flow example, without libraries

java

rest

authentication

oauth

restful-authentication