OAuth 1.0a Request Authorization for Node and Browser
Send OAuth request with your favorite HTTP client (request, jQuery.ajax...)
No more headache about OAuth 1.0a's stuff or "oauth_consumer_key, oauth_nonce, oauth_signature...." parameters, just use your familiar HTTP client to send OAuth requests.
Tested on some popular OAuth 1.0a services:
- Flickr
- Bitbucket
- Openbankproject(HMAC-SHA256)
Quick Start
const crypto = const OAuth = const oauth =
Get OAuth request data that can be easily used with your http client:
oauth
Or if you want to get as a header key-value pair:
oauth
Crypto
Starting with version 2.0.0
, crypto/hash stuff is separated.
oauth-1.0a
will use your hash_function
to sign.
Example
Node.js
const crypto = { return crypto } const oauth =
- sha1:
crypto.createHmac('sha1', key).update(base_string).digest('base64');
- sha256:
crypto.createHmac('sha256', key).update(base_string).digest('base64');
Browser
Using Google's CryptoJS
- sha1:
CryptoJS.HmacSHA1(base_string, key).toString(CryptoJS.enc.Base64);
- sha256:
CryptoJS.HmacSHA256(base_string, key).toString(CryptoJS.enc.Base64);
Installation
Node.js
$ npm install oauth-1.0a --production
- You can use the native crypto package for
hash_function
. - It is possible for Node.js to be built without including support for the crypto module. In such cases, calling
require('crypto')
will result in an error being thrown. - You can use your own hash function which has format as:
function(base_string, key) return <string>
Browser
Download oauth-1.0a.js here
And also your crypto lib. For example CryptoJS
<!-- sha1 --><!-- sha256 -->
Example
request library (Node.js):
Work with the// Dependenciesconst request = const OAuth = const crypto = // Initializeconst oauth = const request_data = url: 'https://api.twitter.com/1/statuses/update.json?include_entities=true' method: 'POST' data: status: 'Hello Ladies + Gentlemen, a signed OAuth request!' // Note: The token is optional for some requestsconst token = key: '370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb' secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE'
Or if you want to send OAuth data in request's header:
jQuery.ajax (Browser):
Work withCaution: Please make sure you understand what happens when using OAuth protocol on the client side here
// Initializeconst oauth = const request_data = url: 'https://api.twitter.com/1/statuses/update.json?include_entities=true' method: 'POST' data: status: 'Hello Ladies + Gentlemen, a signed OAuth request!' // Note: The token is optional for some requestsconst token = key: '370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb' secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE' $
Or if you want to send OAuth data in request's header:
$
.authorize(/_ options _/)
- url:
String
- method:
String
default'GET'
- data:
Object
any custom data you want to send with, including extra oauth optionoauth_*
as oauth_callback, oauth_version... - includeBodyHash:
Boolean
defaultfalse
set to true if you wantoauth_body_hash
signing (you will need to have define thebody_hash_function
in most cases - for HMAC-SHA1 Oauth signature method, thebody_hash_function
should return a SHA1 hash).
const request_data = url: 'https://bitbucket.org/api/1.0/oauth/request_token' method: 'POST' data: oauth_callback: 'http://www.ddo.me'
.toHeader(/_ signed data _/)
Convert signed data into headers:
$
Init Options
const oauth =
consumer
:Object
Required
your consumer keys
key: <your consumer key> secret: <your consumer secret>
signature_method
:String
default'PLAINTEXT'
hash_function
:Function
ifsignature_method
='PLAINTEXT'
defaultreturn key
body_hash_function
:Function
default tohash_function
nonce_length
:Int
default32
version
:String
default'1.0'
parameter_seperator
:String
for header only, default', '
. Note that there is a space after,
realm
:String
last_ampersand
:Bool
defaulttrue
. For some services if there is no Token Secret then no need&
at the end. Check oauth doc for more information
oauth_signature is set to the concatenated encoded values of the Consumer Secret and Token Secret, separated by a '&' character (ASCII code 38), even if either secret is empty
Notes
- Some OAuth requests without token use
.authorize(request_data)
instead of.authorize(request_data, {})
- Or just token key only
.authorize(request_data, {key: 'xxxxx'})
- Want easier? Take a look:
- Node.js: oauth-request
- jquery: soon
Client Side Usage Caution
OAuth is based around allowing tools and websites to talk to each other. However, JavaScript running in web browsers is hampered by security restrictions that prevent code running on one website from accessing data stored or served on another.
Before you start hacking, make sure you understand the limitations posed by cross-domain XMLHttpRequest.
On the bright side, some platforms use JavaScript as their language, but enable the programmer to access other web sites. Examples include:
- Google/Firefox/Safari extensions
- Google Gadgets
- Microsoft Sidebar
For those platforms, this library should come in handy.
Changelog
Contributors
License
MIT