-59
-60
-61
+62
+63
+64
|
- # File 'lib/oauth/request_proxy/base.rb', line 59
+ # File 'lib/oauth/request_proxy/base.rb', line 62
def oauth_verifier
parameters["oauth_verifier"]
@@ -1528,12 +1540,12 @@
-63
-64
-65
+66
+67
+68
|
- # File 'lib/oauth/request_proxy/base.rb', line 63
+ # File 'lib/oauth/request_proxy/base.rb', line 66
def oauth_version
parameters["oauth_version"]
@@ -1581,12 +1593,12 @@
-77
-78
-79
+80
+81
+82
|
- # File 'lib/oauth/request_proxy/base.rb', line 77
+ # File 'lib/oauth/request_proxy/base.rb', line 80
def parameters
raise NotImplementedError, "Must be implemented by subclasses"
@@ -1611,12 +1623,12 @@
-81
-82
-83
+84
+85
+86
|
- # File 'lib/oauth/request_proxy/base.rb', line 81
+ # File 'lib/oauth/request_proxy/base.rb', line 84
def parameters_for_signature
parameters.select { |k, _v| !signature_and_unsigned_parameters.include?(k) }
@@ -1664,16 +1676,16 @@
-152
-153
-154
155
156
157
-158
+158
+159
+160
+161
|
- # File 'lib/oauth/request_proxy/base.rb', line 152
+ # File 'lib/oauth/request_proxy/base.rb', line 155
def query_string_blank?
if (uri = request.env["REQUEST_URI"])
@@ -1702,12 +1714,12 @@
-108
-109
-110
+111
+112
+113
|
- # File 'lib/oauth/request_proxy/base.rb', line 108
+ # File 'lib/oauth/request_proxy/base.rb', line 111
def sign(options = {})
OAuth::Signature.sign(self, options)
@@ -1732,14 +1744,14 @@
-112
-113
-114
115
-116
+116
+117
+118
+119
|
- # File 'lib/oauth/request_proxy/base.rb', line 112
+ # File 'lib/oauth/request_proxy/base.rb', line 115
def sign!(options = {})
parameters["oauth_signature"] = sign(options)
@@ -1766,12 +1778,12 @@
-93
-94
-95
+96
+97
+98
|
- # File 'lib/oauth/request_proxy/base.rb', line 93
+ # File 'lib/oauth/request_proxy/base.rb', line 96
def signature_and_unsigned_parameters
unsigned_parameters + ["oauth_signature"]
@@ -1806,13 +1818,13 @@
-119
-120
-121
-122
+122
+123
+124
+125
|
- # File 'lib/oauth/request_proxy/base.rb', line 119
+ # File 'lib/oauth/request_proxy/base.rb', line 122
def signature_base_string
base = [method, normalized_uri, normalized_parameters]
@@ -1861,12 +1873,12 @@
-125
-126
-127
+128
+129
+130
|
- # File 'lib/oauth/request_proxy/base.rb', line 125
+ # File 'lib/oauth/request_proxy/base.rb', line 128
def signed?
@signed
@@ -1901,9 +1913,6 @@
-130
-131
-132
133
134
135
@@ -1913,10 +1922,13 @@
139
140
141
-142
+142
+143
+144
+145
|
- # File 'lib/oauth/request_proxy/base.rb', line 130
+ # File 'lib/oauth/request_proxy/base.rb', line 133
def signed_uri(with_oauth: true)
if signed?
@@ -1941,7 +1953,7 @@
diff --git a/docs/OAuth/RequestProxy/Curl.html b/docs/OAuth/RequestProxy/Curl.html
index e31855e3..17db00e9 100644
--- a/docs/OAuth/RequestProxy/Curl.html
+++ b/docs/OAuth/RequestProxy/Curl.html
@@ -105,7 +105,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/RequestProxy/Curl/Easy.html b/docs/OAuth/RequestProxy/Curl/Easy.html
index 954cd148..7dfb9897 100644
--- a/docs/OAuth/RequestProxy/Curl/Easy.html
+++ b/docs/OAuth/RequestProxy/Curl/Easy.html
@@ -330,7 +330,7 @@
diff --git a/docs/OAuth/RequestProxy/EventMachine.html b/docs/OAuth/RequestProxy/EventMachine.html
index c89c5da6..e76c6c87 100644
--- a/docs/OAuth/RequestProxy/EventMachine.html
+++ b/docs/OAuth/RequestProxy/EventMachine.html
@@ -105,7 +105,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/RequestProxy/EventMachine/HttpRequest.html b/docs/OAuth/RequestProxy/EventMachine/HttpRequest.html
index b372d87f..efcbb08b 100644
--- a/docs/OAuth/RequestProxy/EventMachine/HttpRequest.html
+++ b/docs/OAuth/RequestProxy/EventMachine/HttpRequest.html
@@ -340,7 +340,7 @@
diff --git a/docs/OAuth/RequestProxy/JabberRequest.html b/docs/OAuth/RequestProxy/JabberRequest.html
index f456ef6b..53e098dc 100644
--- a/docs/OAuth/RequestProxy/JabberRequest.html
+++ b/docs/OAuth/RequestProxy/JabberRequest.html
@@ -417,7 +417,7 @@
diff --git a/docs/OAuth/RequestProxy/MockRequest.html b/docs/OAuth/RequestProxy/MockRequest.html
index f9963627..42b82047 100644
--- a/docs/OAuth/RequestProxy/MockRequest.html
+++ b/docs/OAuth/RequestProxy/MockRequest.html
@@ -407,7 +407,7 @@
diff --git a/docs/OAuth/RequestProxy/Net.html b/docs/OAuth/RequestProxy/Net.html
index 41c8f3bf..75629671 100644
--- a/docs/OAuth/RequestProxy/Net.html
+++ b/docs/OAuth/RequestProxy/Net.html
@@ -105,7 +105,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/RequestProxy/Net/HTTP.html b/docs/OAuth/RequestProxy/Net/HTTP.html
index 434cf263..4df05347 100644
--- a/docs/OAuth/RequestProxy/Net/HTTP.html
+++ b/docs/OAuth/RequestProxy/Net/HTTP.html
@@ -105,7 +105,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/RequestProxy/Net/HTTP/HTTPRequest.html b/docs/OAuth/RequestProxy/Net/HTTP/HTTPRequest.html
index 36a5e881..b2c078c8 100644
--- a/docs/OAuth/RequestProxy/Net/HTTP/HTTPRequest.html
+++ b/docs/OAuth/RequestProxy/Net/HTTP/HTTPRequest.html
@@ -383,7 +383,7 @@
diff --git a/docs/OAuth/RequestProxy/RackRequest.html b/docs/OAuth/RequestProxy/RackRequest.html
index a9a29eac..a7fbbbe3 100644
--- a/docs/OAuth/RequestProxy/RackRequest.html
+++ b/docs/OAuth/RequestProxy/RackRequest.html
@@ -389,7 +389,7 @@
diff --git a/docs/OAuth/RequestProxy/RestClient.html b/docs/OAuth/RequestProxy/RestClient.html
index c2d9a6a6..76090a94 100644
--- a/docs/OAuth/RequestProxy/RestClient.html
+++ b/docs/OAuth/RequestProxy/RestClient.html
@@ -105,7 +105,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/RequestProxy/RestClient/Request.html b/docs/OAuth/RequestProxy/RestClient/Request.html
index c2060756..597f817e 100644
--- a/docs/OAuth/RequestProxy/RestClient/Request.html
+++ b/docs/OAuth/RequestProxy/RestClient/Request.html
@@ -330,7 +330,7 @@
diff --git a/docs/OAuth/RequestProxy/Typhoeus.html b/docs/OAuth/RequestProxy/Typhoeus.html
index 88365dca..c3fccf88 100644
--- a/docs/OAuth/RequestProxy/Typhoeus.html
+++ b/docs/OAuth/RequestProxy/Typhoeus.html
@@ -105,7 +105,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/RequestProxy/Typhoeus/Request.html b/docs/OAuth/RequestProxy/Typhoeus/Request.html
index b27c3fab..0161d100 100644
--- a/docs/OAuth/RequestProxy/Typhoeus/Request.html
+++ b/docs/OAuth/RequestProxy/Typhoeus/Request.html
@@ -332,7 +332,7 @@
diff --git a/docs/OAuth/RequestProxy/UnknownRequestType.html b/docs/OAuth/RequestProxy/UnknownRequestType.html
index 6df208af..bef2a962 100644
--- a/docs/OAuth/RequestProxy/UnknownRequestType.html
+++ b/docs/OAuth/RequestProxy/UnknownRequestType.html
@@ -114,7 +114,7 @@
diff --git a/docs/OAuth/RequestToken.html b/docs/OAuth/RequestToken.html
index 45dac62e..81c30c73 100644
--- a/docs/OAuth/RequestToken.html
+++ b/docs/OAuth/RequestToken.html
@@ -473,7 +473,7 @@
diff --git a/docs/OAuth/Server.html b/docs/OAuth/Server.html
index 642d1295..05f6ab6d 100644
--- a/docs/OAuth/Server.html
+++ b/docs/OAuth/Server.html
@@ -830,7 +830,7 @@
diff --git a/docs/OAuth/ServerToken.html b/docs/OAuth/ServerToken.html
index 5bbf56e4..9442213e 100644
--- a/docs/OAuth/ServerToken.html
+++ b/docs/OAuth/ServerToken.html
@@ -230,7 +230,7 @@
diff --git a/docs/OAuth/Signature.html b/docs/OAuth/Signature.html
index 8596ca91..b2902c17 100644
--- a/docs/OAuth/Signature.html
+++ b/docs/OAuth/Signature.html
@@ -535,7 +535,7 @@
diff --git a/docs/OAuth/Signature/Base.html b/docs/OAuth/Signature/Base.html
index e588c56b..220baff4 100644
--- a/docs/OAuth/Signature/Base.html
+++ b/docs/OAuth/Signature/Base.html
@@ -915,7 +915,7 @@
diff --git a/docs/OAuth/Signature/HMAC.html b/docs/OAuth/Signature/HMAC.html
index 89059654..8582d78a 100644
--- a/docs/OAuth/Signature/HMAC.html
+++ b/docs/OAuth/Signature/HMAC.html
@@ -107,7 +107,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/Signature/HMAC/SHA1.html b/docs/OAuth/Signature/HMAC/SHA1.html
index 1a31f41e..2bfdcb8d 100644
--- a/docs/OAuth/Signature/HMAC/SHA1.html
+++ b/docs/OAuth/Signature/HMAC/SHA1.html
@@ -216,7 +216,7 @@
diff --git a/docs/OAuth/Signature/HMAC/SHA256.html b/docs/OAuth/Signature/HMAC/SHA256.html
index 341694ab..9211eb00 100644
--- a/docs/OAuth/Signature/HMAC/SHA256.html
+++ b/docs/OAuth/Signature/HMAC/SHA256.html
@@ -216,7 +216,7 @@
diff --git a/docs/OAuth/Signature/PLAINTEXT.html b/docs/OAuth/Signature/PLAINTEXT.html
index f6b3e86d..8901c040 100644
--- a/docs/OAuth/Signature/PLAINTEXT.html
+++ b/docs/OAuth/Signature/PLAINTEXT.html
@@ -375,7 +375,7 @@
diff --git a/docs/OAuth/Signature/RSA.html b/docs/OAuth/Signature/RSA.html
index b075b17a..104f22a9 100644
--- a/docs/OAuth/Signature/RSA.html
+++ b/docs/OAuth/Signature/RSA.html
@@ -105,7 +105,7 @@ Defined Under Namespace
diff --git a/docs/OAuth/Signature/RSA/SHA1.html b/docs/OAuth/Signature/RSA/SHA1.html
index e1e5dc8f..d8736c52 100644
--- a/docs/OAuth/Signature/RSA/SHA1.html
+++ b/docs/OAuth/Signature/RSA/SHA1.html
@@ -352,7 +352,7 @@
diff --git a/docs/OAuth/Signature/UnknownSignatureMethod.html b/docs/OAuth/Signature/UnknownSignatureMethod.html
index b86db311..7e694f79 100644
--- a/docs/OAuth/Signature/UnknownSignatureMethod.html
+++ b/docs/OAuth/Signature/UnknownSignatureMethod.html
@@ -114,7 +114,7 @@
diff --git a/docs/OAuth/Token.html b/docs/OAuth/Token.html
index 461a86cc..c613c120 100644
--- a/docs/OAuth/Token.html
+++ b/docs/OAuth/Token.html
@@ -428,7 +428,7 @@
diff --git a/docs/OAuth/Unauthorized.html b/docs/OAuth/Unauthorized.html
index 4a4f8212..e2596d58 100644
--- a/docs/OAuth/Unauthorized.html
+++ b/docs/OAuth/Unauthorized.html
@@ -351,7 +351,7 @@
diff --git a/docs/OAuth/Version.html b/docs/OAuth/Version.html
index 10727d86..1f5c53c9 100644
--- a/docs/OAuth/Version.html
+++ b/docs/OAuth/Version.html
@@ -111,7 +111,7 @@
diff --git a/docs/_index.html b/docs/_index.html
index c9bd9d69..a4e5df9a 100644
--- a/docs/_index.html
+++ b/docs/_index.html
@@ -369,6 +369,13 @@ Namespace Listing A-Z
+
+ Optional
+
+ (OAuth)
+
+
+
@@ -583,7 +590,7 @@ Namespace Listing A-Z
diff --git a/docs/class_list.html b/docs/class_list.html
index cca39ba9..8e1be508 100644
--- a/docs/class_list.html
+++ b/docs/class_list.html
@@ -46,7 +46,7 @@
-Base < Object ActionController
Error < StandardError OAuth Base < Object OAuth::RequestProxy Easy < Base OAuth::RequestProxy::Curl
HTTPOAuth::RequestProxy::Net
Request < Base OAuth::RequestProxy::RestClient
Request < Base OAuth::RequestProxy::Typhoeus
Base < Object OAuth::Signature SHA1 < Base OAuth::Signature::HMAC SHA256 < Base OAuth::Signature::HMAC
SHA1 < Base OAuth::Signature::RSA
Base < Object ActionController
Error < StandardError OAuth Base < Object OAuth::RequestProxy Easy < Base OAuth::RequestProxy::Curl
HTTPOAuth::RequestProxy::Net
Request < Base OAuth::RequestProxy::RestClient
Request < Base OAuth::RequestProxy::Typhoeus
Base < Object OAuth::Signature SHA1 < Base OAuth::Signature::HMAC SHA256 < Base OAuth::Signature::HMAC
SHA1 < Base OAuth::Signature::RSA
diff --git a/docs/file.CHANGELOG.html b/docs/file.CHANGELOG.html
index ad6d6ef9..08d696fb 100644
--- a/docs/file.CHANGELOG.html
+++ b/docs/file.CHANGELOG.html
@@ -71,14 +71,28 @@
Added
- - kettle-dev v1.1.18
+
- kettle-dev v1.1.18
+ - Internal escape & unescape methods
+
+ - Stop relying on URI / CGI for escaping and unescaping
+ - They are both unstable across supported versions of Ruby (including 3.5 HEAD)
+
+
+ - Tests against Rails-specific code are now run in CI
+ - Documented OAuth 1.0, 1.0a differences
Changed
- converted minitest => rspec
Deprecated
Removed
- Fixed
- Security
+
+ - dependency on em-http-request
+
+ - now lazy Loaded so it can be optional, since some systems fail to install it, and it doesn’t seem maintained
+
Fixed
+ Security
+
+
@@ -676,7 +690,7 @@ Added
diff --git a/docs/file.CITATION.html b/docs/file.CITATION.html
index 776c0141..78c697fc 100644
--- a/docs/file.CITATION.html
+++ b/docs/file.CITATION.html
@@ -82,7 +82,7 @@
diff --git a/docs/file.CODE_OF_CONDUCT.html b/docs/file.CODE_OF_CONDUCT.html
index ef4a0d83..84b063fe 100644
--- a/docs/file.CODE_OF_CONDUCT.html
+++ b/docs/file.CODE_OF_CONDUCT.html
@@ -191,7 +191,7 @@ Attribution
diff --git a/docs/file.CONTRIBUTING.html b/docs/file.CONTRIBUTING.html
index 332d6e97..4f3a7716 100644
--- a/docs/file.CONTRIBUTING.html
+++ b/docs/file.CONTRIBUTING.html
@@ -308,7 +308,7 @@ Manual process
diff --git a/docs/file.FUNDING.html b/docs/file.FUNDING.html
index 2c7db7a3..e66a1f7a 100644
--- a/docs/file.FUNDING.html
+++ b/docs/file.FUNDING.html
@@ -104,7 +104,7 @@ Another Way to Support Open
diff --git a/docs/file.LICENSE.html b/docs/file.LICENSE.html
index 78a65b77..e33e0ff7 100644
--- a/docs/file.LICENSE.html
+++ b/docs/file.LICENSE.html
@@ -60,7 +60,7 @@
The MIT License (MIT)
Copyright (c) 2020-2025 Peter H. Boling, of Galtzo.com, and oauth contributors
Copyright (c) 2007-2012, 2016-2017 Blaine Cook, Larry Halff, Pelle Braendgaard
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE. 🌻 Synopsis
oauth2 sibling gem for OAuth 2.0 implementations in Ruby.
+OAuth 1.0 vs 1.0a: What this library implements
+
+This gem targets the OAuth 1.0a behavior (the errata that became RFC 5849), while maintaining compatibility with providers that still behave like classic 1.0.
+Here are the key lines between the two and how this gem handles them:
+
+
+ - oauth_callback
+
+ - 1.0: Optional in practice; some providers accepted flows without it.
+ - 1.0a: Consumer SHOULD send oauth_callback when obtaining a Request Token, or explicitly use the out-of-band value “oob”.
+ - This gem: If you do not pass oauth_callback, we default it to “oob” (OUT_OF_BAND). You can opt-out by passing exclude_callback: true.
+
+
+ - oauth_callback_confirmed
+
+ - 1.0: Not specified.
+ - 1.0a: Service Provider MUST return oauth_callback_confirmed=true with the Request Token response. This mitigates session fixation.
+ - This gem: Parses token responses but does not include oauth_callback_confirmed in the signature base string (it is a response param, not a signed request param).
+
+
+ - oauth_verifier
+
+ - 1.0: Not present.
+ - 1.0a: After the user authorizes, the Provider returns an oauth_verifier to the Consumer, and the Consumer MUST include it when exchanging the Request Token for an Access Token.
+ - This gem: Supports oauth_verifier across request helpers and request proxies; pass oauth_verifier to get_access_token in 3‑legged flows.
+
+
+
+
+Practical guidance:
+
+ - For 3‑legged flows, always supply oauth_callback when calling consumer.get_request_token, and include oauth_verifier when calling request_token.get_access_token.
+ - For command‑line or non-HTTP clients, use the special OUT_OF_BAND value (“oob”) as the oauth_callback and prompt the user to paste back the displayed verifier.
+
+
+References: RFC 5849 (OAuth 1.0), sections 5–7; 1.0a security errata.
+
OAuth Ruby has been maintained by a large number of talented
individuals over the years.
The primary maintainer since 2020 is Peter Boling (@pboling).
@@ -552,7 +589,7 @@ Please give the project a star ⭐ ♥
diff --git a/docs/file.REEK.html b/docs/file.REEK.html
index a0fc47a4..d576468b 100644
--- a/docs/file.REEK.html
+++ b/docs/file.REEK.html
@@ -61,7 +61,7 @@
diff --git a/docs/file.RUBOCOP.html b/docs/file.RUBOCOP.html
index 974313be..ffbc1200 100644
--- a/docs/file.RUBOCOP.html
+++ b/docs/file.RUBOCOP.html
@@ -161,7 +161,7 @@ Benefits of rubocop_gradual
diff --git a/docs/file.SECURITY.html b/docs/file.SECURITY.html
index 62b77c04..39630bf9 100644
--- a/docs/file.SECURITY.html
+++ b/docs/file.SECURITY.html
@@ -128,7 +128,7 @@ Additional Support
diff --git a/docs/index.html b/docs/index.html
index 78464185..0aa93e60 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -84,6 +84,43 @@ 🌻 Synopsis
oauth2 sibling gem for OAuth 2.0 implementations in Ruby.
+OAuth 1.0 vs 1.0a: What this library implements
+
+This gem targets the OAuth 1.0a behavior (the errata that became RFC 5849), while maintaining compatibility with providers that still behave like classic 1.0.
+Here are the key lines between the two and how this gem handles them:
+
+
+ - oauth_callback
+
+ - 1.0: Optional in practice; some providers accepted flows without it.
+ - 1.0a: Consumer SHOULD send oauth_callback when obtaining a Request Token, or explicitly use the out-of-band value “oob”.
+ - This gem: If you do not pass oauth_callback, we default it to “oob” (OUT_OF_BAND). You can opt-out by passing exclude_callback: true.
+
+
+ - oauth_callback_confirmed
+
+ - 1.0: Not specified.
+ - 1.0a: Service Provider MUST return oauth_callback_confirmed=true with the Request Token response. This mitigates session fixation.
+ - This gem: Parses token responses but does not include oauth_callback_confirmed in the signature base string (it is a response param, not a signed request param).
+
+
+ - oauth_verifier
+
+ - 1.0: Not present.
+ - 1.0a: After the user authorizes, the Provider returns an oauth_verifier to the Consumer, and the Consumer MUST include it when exchanging the Request Token for an Access Token.
+ - This gem: Supports oauth_verifier across request helpers and request proxies; pass oauth_verifier to get_access_token in 3‑legged flows.
+
+
+
+
+Practical guidance:
+
+ - For 3‑legged flows, always supply oauth_callback when calling consumer.get_request_token, and include oauth_verifier when calling request_token.get_access_token.
+ - For command‑line or non-HTTP clients, use the special OUT_OF_BAND value (“oob”) as the oauth_callback and prompt the user to paste back the displayed verifier.
+
+
+References: RFC 5849 (OAuth 1.0), sections 5–7; 1.0a security errata.
+
OAuth Ruby has been maintained by a large number of talented
individuals over the years.
The primary maintainer since 2020 is Peter Boling (@pboling).
@@ -552,7 +589,7 @@ Please give the project a star ⭐ ♥
diff --git a/docs/method_list.html b/docs/method_list.html
index e3111ba2..ba3ee007 100644
--- a/docs/method_list.html
+++ b/docs/method_list.html
@@ -368,6 +368,14 @@
+
+
+
+
+
escape
OAuth::Helper
@@ -375,7 +383,7 @@
-
+
from_hash
OAuth::ConsumerToken
@@ -383,7 +391,7 @@
-
+
#generate_consumer_credentials
OAuth::Server
@@ -391,7 +399,7 @@
-
+
#generate_credentials
OAuth::Server
@@ -399,7 +407,7 @@
-
+
generate_key
OAuth::Helper
@@ -407,7 +415,7 @@
-
+
generate_timestamp
OAuth::Helper
@@ -415,7 +423,7 @@
-
+
#get
OAuth::AccessToken
@@ -423,7 +431,7 @@
-
+
#get_access_token
OAuth::Consumer
@@ -431,7 +439,7 @@
-
+
#get_access_token
OAuth::RequestToken
@@ -439,7 +447,7 @@
-
+
#get_request_token
OAuth::Consumer
@@ -447,7 +455,7 @@
-
+
#hash_body
OAuth::Client::Helper
@@ -455,7 +463,7 @@
-
+
#head
OAuth::AccessToken
@@ -463,7 +471,7 @@
-
+
#header
OAuth::Client::Helper
@@ -471,7 +479,7 @@
-
+
#http
OAuth::Consumer
@@ -479,7 +487,7 @@
-
+
#http_method
OAuth::Consumer
@@ -487,7 +495,7 @@
-
+
implements
OAuth::Signature::Base
@@ -495,7 +503,7 @@
-
+
#initialize
OAuth::Server
@@ -503,7 +511,7 @@
-
+
#initialize
OAuth::Consumer
@@ -511,7 +519,7 @@
-
+
#initialize
OAuth::Token
@@ -519,7 +527,7 @@
-
+
#initialize
OAuth::Client::Helper
@@ -527,7 +535,7 @@
-
+
#initialize
OAuth::Problem
@@ -535,7 +543,7 @@
-
+
#initialize
OAuth::Signature::Base
@@ -543,7 +551,7 @@
-
+
#initialize
OAuth::RequestProxy::Base
@@ -551,7 +559,7 @@
-
+
#initialize
OAuth::Unauthorized
@@ -559,7 +567,7 @@
-
+
#initialize
OAuth::ServerToken
@@ -567,7 +575,7 @@
-
+
#initialize
OAuth::ConsumerToken
@@ -575,7 +583,7 @@
-
+
#key
OAuth::Consumer
@@ -583,7 +591,7 @@
-
+
#method
OAuth::RequestProxy::Net::HTTP::HTTPRequest
@@ -591,7 +599,7 @@
-
+
#method
OAuth::RequestProxy::Curl::Easy
@@ -599,7 +607,7 @@
-
+
#method
OAuth::RequestProxy::MockRequest
@@ -607,7 +615,7 @@
-
+
#method
OAuth::RequestProxy::RackRequest
@@ -615,7 +623,7 @@
-
+
#method
OAuth::RequestProxy::JabberRequest
@@ -623,7 +631,7 @@
-
+
#method
OAuth::RequestProxy::EventMachine::HttpRequest
@@ -631,7 +639,7 @@
-
+
#method
OAuth::RequestProxy::Typhoeus::Request
@@ -639,7 +647,7 @@
-
+
#method
OAuth::RequestProxy::RestClient::Request
@@ -647,7 +655,7 @@
-
+
#method
OAuth::RequestProxy::ActionControllerRequest
@@ -655,7 +663,7 @@
-
+
#mock_incoming_request_with_authorize_header
OAuth::OAuthTestHelper
@@ -663,7 +671,7 @@
-
+
#mock_incoming_request_with_query
OAuth::OAuthTestHelper
@@ -671,7 +679,7 @@
-
+
#non_oauth_parameters
OAuth::RequestProxy::Base
@@ -679,7 +687,7 @@
-
+
#nonce
OAuth::Client::Helper
@@ -687,7 +695,7 @@
-
+
normalize
OAuth::Helper
@@ -695,7 +703,7 @@
-
+
normalize_nested_query
OAuth::Helper
@@ -703,7 +711,7 @@
-
+
#normalize_uri
EventMachine::HttpClient
@@ -711,7 +719,7 @@
-
+
#normalized_parameters
OAuth::RequestProxy::Base
@@ -719,7 +727,7 @@
-
+
#normalized_uri
OAuth::RequestProxy::Base
@@ -727,7 +735,7 @@
-
+
#normalized_uri
OAuth::RequestProxy::MockRequest
@@ -735,7 +743,7 @@
-
+
#normalized_uri
OAuth::RequestProxy::JabberRequest
@@ -743,7 +751,7 @@
-
+
#oauth!
EventMachine::HttpClient
@@ -751,7 +759,7 @@
-
+
#oauth!
Net::HTTPGenericRequest
@@ -759,7 +767,7 @@
-
+
#oauth_callback
OAuth::RequestProxy::Base
@@ -767,7 +775,7 @@
-
+
#oauth_consumer_key
OAuth::RequestProxy::Base
@@ -775,7 +783,7 @@
-
+
#oauth_header
OAuth::RequestProxy::Base
@@ -783,7 +791,7 @@
-
+
#oauth_helper
EventMachine::HttpClient
@@ -791,7 +799,7 @@
-
+
#oauth_helper
Net::HTTPGenericRequest
@@ -799,7 +807,7 @@
-
+
#oauth_nonce
OAuth::RequestProxy::Base
@@ -807,7 +815,7 @@
-
+
#oauth_parameters
OAuth::Client::Helper
@@ -815,7 +823,7 @@
-
+
#oauth_parameters
OAuth::RequestProxy::Base
@@ -823,7 +831,7 @@
-
+
#oauth_signature
OAuth::RequestProxy::Base
@@ -831,7 +839,7 @@
-
+
#oauth_signature_method
OAuth::RequestProxy::Base
@@ -839,7 +847,7 @@
-
+
#oauth_timestamp
OAuth::RequestProxy::Base
@@ -847,7 +855,7 @@
-
+
#oauth_token
OAuth::RequestProxy::Base
@@ -855,7 +863,7 @@
-
+
#oauth_verifier
OAuth::RequestProxy::Base
@@ -863,7 +871,7 @@
-
+
#oauth_version
OAuth::RequestProxy::Base
@@ -871,7 +879,7 @@
-
+
#options
OAuth::Consumer
@@ -879,7 +887,7 @@
-
+
#options
OAuth::Client::Helper
@@ -887,7 +895,7 @@
-
+
#options
OAuth::Signature::Base
@@ -895,7 +903,7 @@
-
+
#options
OAuth::RequestProxy::Base
@@ -903,7 +911,7 @@
-
+
#parameters
OAuth::Client::Helper
@@ -911,7 +919,7 @@
-
+
#parameters
OAuth::RequestProxy::Base
@@ -919,7 +927,7 @@
-
+
#parameters
OAuth::RequestProxy::Net::HTTP::HTTPRequest
@@ -927,7 +935,7 @@
-
+
#parameters
OAuth::RequestProxy::Curl::Easy
@@ -935,7 +943,7 @@
-
+
#parameters
OAuth::RequestProxy::MockRequest
@@ -943,7 +951,7 @@
-
+
#parameters
OAuth::RequestProxy::RackRequest
@@ -951,7 +959,7 @@
-
+
#parameters
OAuth::RequestProxy::JabberRequest
@@ -959,7 +967,7 @@
-
+
#parameters
OAuth::RequestProxy::EventMachine::HttpRequest
@@ -967,7 +975,7 @@
-
+
#parameters
OAuth::RequestProxy::Typhoeus::Request
@@ -975,7 +983,7 @@
-
+
#parameters
OAuth::RequestProxy::RestClient::Request
@@ -983,6 +991,14 @@
+
+
+ #parameters
+ OAuth::RequestProxy::ActionDispatchRequest
+
+
+
#parameters
@@ -1616,6 +1632,14 @@
+
+ #uri
+ OAuth::RequestProxy::ActionDispatchRequest
+
+
+
+
#uri
OAuth::RequestProxy::ActionControllerRequest
@@ -1623,7 +1647,7 @@
-
+
use_oauth?
ActionController::TestRequest
@@ -1631,7 +1655,7 @@
-
+
verify
OAuth::Signature
@@ -1639,7 +1663,7 @@
-
+
#verify
OAuth::Signature::Base
diff --git a/docs/top-level-namespace.html b/docs/top-level-namespace.html
index e2f7a493..dc905275 100644
--- a/docs/top-level-namespace.html
+++ b/docs/top-level-namespace.html
@@ -100,7 +100,7 @@ Defined Under Namespace
diff --git a/lib/oauth/consumer.rb b/lib/oauth/consumer.rb
index 595aaef5..50607e89 100644
--- a/lib/oauth/consumer.rb
+++ b/lib/oauth/consumer.rb
@@ -142,6 +142,21 @@ def uri(custom_uri = nil)
end
end
+ # Exchanges a verified Request Token for an Access Token.
+ #
+ # OAuth 1.0 vs 1.0a:
+ # - 1.0a requires including oauth_verifier (as returned by the Provider after
+ # user authorization) when performing this exchange in a 3‑legged flow.
+ # - 1.0 flows did not include oauth_verifier.
+ #
+ # Usage (3‑legged):
+ # access_token = request_token.get_access_token(oauth_verifier: params[:oauth_verifier])
+ #
+ # @param request_token [OAuth::RequestToken] The authorized request token
+ # @param request_options [Hash] OAuth or request options (include :oauth_verifier for 1.0a)
+ # @param arguments [Array] Optional POST body and headers
+ # @yield [response_body] If a block is given, yields the raw response body.
+ # @return [OAuth::AccessToken]
def get_access_token(request_token, request_options = {}, *arguments, &block)
response = token_request(
http_method,
@@ -156,18 +171,34 @@ def get_access_token(request_token, request_options = {}, *arguments, &block)
# Makes a request to the service for a new OAuth::RequestToken
#
- # @request_token = @consumer.get_request_token
+ # Example:
+ # @request_token = @consumer.get_request_token
#
# To include OAuth parameters:
- #
- # @request_token = @consumer.get_request_token \
- # :oauth_callback => "http://example.com/cb"
+ # @request_token = @consumer.get_request_token(
+ # oauth_callback: "http://example.com/cb"
+ # )
#
# To include application-specific parameters:
+ # @request_token = @consumer.get_request_token({}, foo: "bar")
+ #
+ # OAuth 1.0 vs 1.0a:
+ # - In 1.0a, the Consumer SHOULD send oauth_callback when obtaining a request token
+ # (or explicitly use OUT_OF_BAND) and the Provider MUST include
+ # oauth_callback_confirmed=true in the response.
+ # - This library defaults oauth_callback to OUT_OF_BAND ("oob") when not provided,
+ # which works for both 1.0 and 1.0a, and mirrors common provider behavior.
+ # - The oauth_callback_confirmed response is parsed by the token classes; it is not
+ # part of the signature base string and thus is not signed.
#
- # @request_token = @consumer.get_request_token({}, :foo => "bar")
+ # TODO: In a future major release, oauth_callback may be made mandatory unless
+ # request_options[:exclude_callback] is set, to reflect 1.0a guidance.
#
- # TODO oauth_callback should be a mandatory parameter
+ # @param request_options [Hash] OAuth options for the request. Notably
+ # :oauth_callback can be set to a URL, or OAuth::OUT_OF_BAND ("oob").
+ # @param arguments [Array] Optional POST body and headers
+ # @yield [response_body] If a block is given, yields the raw response body.
+ # @return [OAuth::RequestToken]
def get_request_token(request_options = {}, *arguments, &block)
# if oauth_callback wasn't provided, it is assumed that oauth_verifiers
# will be exchanged out of band
diff --git a/lib/oauth/oauth.rb b/lib/oauth/oauth.rb
index b8b09b31..da430ed9 100644
--- a/lib/oauth/oauth.rb
+++ b/lib/oauth/oauth.rb
@@ -1,11 +1,24 @@
# frozen_string_literal: true
module OAuth
- # request tokens are passed between the consumer and the provider out of
- # band (i.e. callbacks cannot be used), per section 6.1.1
+ # Out-Of-Band callback token value.
+ # OAuth 1.0 and 1.0a both support out-of-band flows, where callbacks cannot be used.
+ # See RFC 5849 (OAuth 1.0), Section 6.1.1: Obtaining an Unauthorized Request Token
+ # and the 1.0a errata. Providers treating "oob" as the callback URL indicate that
+ # the verifier (for 1.0a) will be communicated out of band to the Consumer.
OUT_OF_BAND = "oob"
- # required parameters, per sections 6.1.1, 6.3.1, and 7
+ # OAuth parameter keys this library recognizes when normalizing/signing requests.
+ # Notes on 1.0 vs 1.0a:
+ # - oauth_verifier: Introduced by OAuth 1.0a. Returned to the Consumer after user
+ # authorization and required when exchanging a Request Token for an Access Token
+ # (Section 6.3.1 in RFC 5849 / 1.0a change).
+ # - oauth_callback: Present in 1.0; 1.0a clarified that the Consumer MUST send it when
+ # obtaining a Request Token (or use "oob") and that the Service Provider MUST return
+ # oauth_callback_confirmed=true with the Request Token response to prevent session
+ # fixation attacks. Note that oauth_callback_confirmed is a response parameter, not
+ # a request signing parameter, and thus is not listed here.
+ # Other keys are common to both 1.0 and 1.0a.
PARAMETERS = %w[
oauth_callback
oauth_consumer_key
diff --git a/lib/oauth/request_proxy/base.rb b/lib/oauth/request_proxy/base.rb
index 7107d63e..e4e57b3e 100644
--- a/lib/oauth/request_proxy/base.rb
+++ b/lib/oauth/request_proxy/base.rb
@@ -56,6 +56,9 @@ def oauth_token
parameters["oauth_token"]
end
+ # OAuth 1.0a only: value returned to the Consumer after user authorization
+ # and required when exchanging a Request Token for an Access Token.
+ # Not present in OAuth 1.0 flows.
def oauth_verifier
parameters["oauth_verifier"]
end
|