Home/ Questions/Q 7058069
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-28T04:04:07+00:00

I am trying to verify an OAuth signature generated in code against a known

  • 0

I am trying to verify an OAuth signature generated in code against a “known reputable source”. All my steps are verified correct except the last, wherein a ‘base signature string’ is HMAC-SHA1 hashed against a secret key and then base64 encoded.

I have confirmed that my hash value is the same as expected by the algorithm. I then disconfirmed that my base64 encode was the same. Attempting to determine why my encode failed, I wanted to check the encoder I was using.

Here is the (hash) string being base64 encoded:

203ebb13a65cccaae5cb1b9d5af51fe41f534357

Here is the base64 encode that results in my code:

MjAzZWJiMTNhNjVjY2NhYWU1Y2IxYjlkNWFmNTFmZTQxZjUzNDM1Nw==

According to http://www.motobit.com/util/base64-decoder-encoder.asp, that is the correct result:

Base64 1

But, according to http://www.online-convert.com/result/096d7b00138f3726daee5f6ddb107a62 (provided with the secret and base string, not the hash), a different base64 should have been output. Note that the hash output is my correct hash despite the difference in base64:

Base64 1

Finally, the “official” tester (http://hueniverse.com/oauth/guide/authentication/) outputs a third different base64 from the same hash:

Base64 1

I have no idea what I’m doing wrong, and the fact that these tools are outputting different results makes me wonder if there is in fact such a thing as base64 encoding or if they are actually using different algorithms? Perhaps the fact that it’s for OAuth would help you help me identify the answer.

Thanks for any leads from the wise.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    OK, in this case the first website was making the same “mistake” I was (in my case it was a mistake, the first website may just be making an unstated assumption).

    That mistake is whether the hash is interpreted as a string (which gets base64encoded) or as a series of hexadecimal values which get base64encoded. In the former case, the resultant encode is longer than the original string, while in the latter the resultant encode is shorter than the original string. This is not only empirically true but the interwebs show that it is one of the concepts behind the standard in the first place.

    The second website, working from (as stated) “hex” data, got the correct answer.

    • 0