1

我是网络编程的新手。我正在尝试在 Dropbox 上基于 OAuth 1.0 发出 POST 请求。以下是我用来发出帖子请求的代码。我应该这样做吗？

HttpPost httpPost;
            Log.d("HTTP","Exec");
            httpPost = new HttpPost("https://api.dropbox.com/1/shares/dropbox/a.jpg");
            Log.d("HTTP","Execute");

            try {
                List<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>(9);
                nameValuePairs.add(new BasicNameValuePair("oauth_consumer_key", "2f2y1dyuqhp58ek"));
                nameValuePairs.add(new BasicNameValuePair("oauth_token", token));
                nameValuePairs.add(new BasicNameValuePair("oauth_nonce", String.valueOf(millis)));
                nameValuePairs.add(new BasicNameValuePair("oauth_timestamp", String.valueOf(millis)));
                nameValuePairs.add(new BasicNameValuePair("oauth_signature_method", "HMAC-SHA1"));
                nameValuePairs.add(new BasicNameValuePair("oauth_version", "1.0"));
                nameValuePairs.add(new BasicNameValuePair("oauth_signature", sw));//this is url encoded
                //nameValuePairs.add(new BasicNameValuePair("path", "/a.jpg"));
                //nameValuePairs.add(new BasicNameValuePair("root", "dropbox"));
                httpPost.setEntity(new UrlEncodedFormEntity(nameValuePairs));

                Log.d("HTTP","requesting");
                HttpResponse response = httpclient.execute(httpPost);

                HttpEntity entity = response.getEntity();
                InputStream is = entity.getContent();
            String result;
                BufferedReader reader = new BufferedReader(new InputStreamReader(is));
                 StringBuilder sb = new StringBuilder();
                 String line = null;
                 line = reader.readLine();
                 sb.append(line); 
                 result = sb.toString();
                 is.close();

                //String s=response.getEntity().getContent().;
                Log.d("resp", result);
                //tv.setText(response.toString());

            } catch (ClientProtocolException e) {
            } catch (IOException e) {
            }

签名基本字符串是：

POST&https%3A%2F%2Fapi.dropbox.com%2F1%2Fshares%2Fdropbox%2Fa.jpg&oauth_consumer_key%3D2f2y1dyuqhp58ek%26oauth_nonce%3D1340729641%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1340729641%26oauth_token%3Dwz27t6thob0fbxl%26oauth_version%3D1.0

T 任何线索可能是什么问题？我得到的响应是 logCat 中显示的“无效签名基本字符串”。

日志猫：

06-26 22:30:46.125: I/System.out(364): debugger has settled (1322)
06-26 22:30:49.203: I/ActivityManager(66): Displayed activity cloud.mobile/.MCActivity: 9393 ms (total 9393 ms)
06-26 22:30:49.243: W/ActivityManager(66): Launch timeout has expired, giving up wake lock!
06-26 22:30:57.124: D/HTTP(364): wz27t6thob0fbxl
06-26 22:30:59.197: D/HTTP(364): Exe
06-26 22:30:59.886: D/HTTP(364): 1340730059
06-26 22:31:00.824: D/HTTP(364): POST&https%3A%2F%2Fapi.dropbox.com%2F1%2Fshares%2Fdropbox%2Fa.jpg&oauth_consumer_key%3D2f2y1dyuqhp58ek%26oauth_nonce%3D1340730059%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1340730059%26oauth_token%3Dwz27t6thob0fbxl%26oauth_version%3D1.0
06-26 22:31:00.824: D/HTTP(364): xLNJrQ5R9jxDTnZcpQ3HLkLBxxQ=
06-26 22:31:00.973: D/HTTP(364): Exe
06-26 22:31:00.983: D/HTTP(364): Exec
06-26 22:31:01.023: D/HTTP(364): Execute
06-26 22:31:01.664: D/HTTP(364): requesting
06-26 22:31:12.243: D/dalvikvm(364): GC_FOR_MALLOC freed 5195 objects / 296968 bytes in 185ms
06-26 22:31:25.063: I/global(364): Default buffer size used in BufferedReader constructor. It would be better to be explicit if an 8k-char buffer is required.
06-26 22:31:28.545: D/resp(364): {"error": "Invalid signature. Expected signature base string: POST&https%3A%2F%2Fapi.dropbox.com%2F1%2Fshares%2Fdropbox%2Fa.jpg&oauth_consumer_key%3D2f2y1dyuqhp58ek%26oauth_nonce%3D1340730059%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1340730059%26oauth_token%3Dwz27t6thob0fbxl%26oauth_version%3D1.0"}

好吧，这个“预期的签名基本字符串（如上所示）”与我使用 HMAC-SHAH 生成并转换为 oauth_signature 的字符串完全相同。我错过了什么吗？

4

1 回答 1

2

您计算 . 的值的方式可能有问题oauth_signature。由于您没有提供代码，因此我将在黑暗中尝试拍摄：

正如Dropbox 论坛中的某个人已经指出的那样

让 OAuth 签名的东西完全正确总是一个巨大的痛苦。您应该努力确保您的库生成的基本字符串与服务器所期望的一样。一旦这是真的，你唯一能搞砸的方法就是用错误的键来hmac。

问题可能是您指定HMAC-SHA1为签名方法，但未使用它正确签署基本字符串。

OAuth 规范命名了三种不同的签名基本字符串的方法。使用HMAC-SHA1时，您必须使用基本字符串和连接值作为输入参数调用该方法。您可以在此处找到在 Java 中使用此方法的示例实现。

由于 Dropbox 使用的是仅 SSL 的 API，您也可以回退到使用PLAINTEXT方法并直接提交基本字符串。

此外，您使用相同的时间戳输入，oauth_timestamp不oauth_nonce推荐使用，oauth_nonce应该始终是唯一的。有关该问题的更详细说明并使用全局计数器来解决它，请阅读本文。

于 2012-06-26T20:31:11.723 回答