Passing querystring parameters in OpenPaths.cc api call with OAuth not working

Question

I am trying to call the OpenPaths.cc rest service API which requires 2-legged OAuth. For this I use the DevDefined.OAuth library (I tried the nuget package and the latest from github). It works when I don't pass parameters in the querystring but returns 400 NOT AUTHORIZED when I do pass parameters.

Working sample with no parameters:

public class OpenPathsRequest
{
    private const string accessKey = "your personal access key";
    private const string secretKey = "your personal secret";
    private const string url = "https://openpaths.cc/api/1";
    private OAuthSession session;

    public OpenPathsRequest()
    {
        var consumerContext = new OAuthConsumerContext
        {
            ConsumerKey = accessKey,
            ConsumerSecret = secretKey,
            SignatureMethod = SignatureMethod.HmacSha1,
            UseHeaderForOAuthParameters = true
        };
        session = new OAuthSession(consumerContext, url, url, url);
    }

    private string GetWebResponseAsString(HttpWebResponse response)
    {
        Encoding enc = System.Text.Encoding.GetEncoding(1252);
        StreamReader loResponseStream = new StreamReader(response.GetResponseStream(), enc);
        return loResponseStream.ReadToEnd();
    }

    public string GetResponse()
    {
        HttpWebResponse response = session.Request().Get().ForUrl(url).ToWebResponse();
        var result = GetWebResponseAsString(response);
        return result;
    }
}

class Program
{
  static void Main(string[] args)
  {
      // create new OpenPathsRequest and get result
      var request = new OpenPathsRequest();
      var response = request.GetResponse();
      Console.WriteLine(response);
      Console.WriteLine("Press any key...");
      Console.ReadKey();
  }
}

But when I change the GetResponse method and pass in 2 parameters (start_time and end_time) like so:

public string GetResponse()
{            
    HttpWebResponse response = session.Request().Get().ForUrl(url).WithQueryParameters(
        new { start_time = 1364962612, end_time = 1364991412  }).ToWebResponse();
    var result = GetWebResponseAsString(response);
    return result;
}

Which results in the following HTTP request (consumer key omitted):

GET https://openpaths.cc/api/1?start_time=1364962612&end_time=1364991412 HTTP/1.1
Authorization: OAuth oauth_nonce="7b5da37a-6227-4ded-ae8b-a695e789ef90",oauth_consumer_key="**********",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1365058952",oauth_version="1.0",oauth_signature="tAk4KMj%2FsiG6BTLSmvDNKXbBpNs%3D"
Host: openpaths.cc
Connection: Keep-Alive

I get the an error response:

HTTP/1.1 400 Bad Request
Date: Thu, 04 Apr 2013 07:03:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Content-Length: 19
Server: TornadoServer/2.0
Set-Cookie: _xsrf=bf20487382b64eeb8646d31b0770db85; Path=/
Set-Cookie: session_id=ZTk2Mjk1MzIzNWNiMmRjMTY1ZmY5Y2ExNWUwMGY5ZTAxZmY1NGIyODljZGJiNzRlMmIyMWI4NTA3YzUwYWJlYg==|1365059006|7459a7ff95039279e9686ceb76b58918fd9f3e48; expires=Thu, 04 Apr 2013 07:18:26 GMT; Path=/

400: NOT AUTHORIZED

All help would be appreciated very much. Thanks in advance.

Harmen

Answer 1

Solved! Apparently OpenPaths.cc api requires signing WITHOUT the additional query parameters in the signature base string. I believe this is not according to OAuth specs, is it? Anyway, with DevDefined.OAuth i can easily solve this by calling SignWithoutToken before calling WithQueryParameters like so:

public string GetResponse()
{            
    HttpWebResponse response = session.Request().Get().ForUrl(url).
        SignWithoutToken().
        WithQueryParameters(new { start_time = 1364962612, end_time = 1364991412  }).
        ToWebResponse();
    var result = GetWebResponseAsString(response);
    return result;
}