[oauth] Re: SimpleGeo requests returning 401 Unauthorized

2010-07-18 Thread John Kristian
Several implementations of OAuth in Python already exist. It would probably help to use one, or at least look at its source code. For examples see http://oauth.net/code/ I'm not familiar with Python, but it looks like the code above fails to percent encode values in several places, and fails to

[oauth] Re: SimpleGeo requests returning 401 Unauthorized

2010-07-18 Thread nvictor
Wow! Thank you so much John. The goal was to avoided a bloated existing solution and do just what I need to do. I trimmed down the code for python-oauth2. Didn't know I was missing that much. I will let you know if it works. On Jul 18, 6:57 pm, John Kristian jmkrist...@gmail.com wrote: Several

[oauth] Re: Timing Vulnerabilities in OAuth framework

2010-07-18 Thread taylor
John, Thanks for working on this. It looks like you're going to extra trouble to hide timing information about the length of the target string. In most cases such as HMAC, this isn't important. However, for plaintext passwords it could be. What will this be used for? Your ternary operator on

Re: [oauth] % character in OAuth request token

2010-07-18 Thread Ivan Pulleyn
On Thu, Jul 8, 2010 at 3:10 PM, Philip Bulley milkisevil...@gmail.comwrote: Google are returning me a request token of “4%252FcMF4t6Bc0i_ojIjMtZ4l1tB3ut4x” which plays havoc with subsequent url encoding! Notice the “%” included in the token. It looks like you've got a double-escape %2F in

[oauth] Re: OAuth questions with Shindig

2010-07-18 Thread Thufir
On Jun 1, 7:32 am, Normandes Jr normande...@gmail.com wrote: [...] My main problem for now is when I try to run this code:   function fetchData() {       var params = {};       url = http://www.google.com/m8/feeds/contacts/default/base? alt=json; [...] which language are you using?

[oauth] Is this even feasible?

2010-07-18 Thread Timothy Perrett
Afternoon all, I am currently looking at implementing a company wide OAuth server. We use salesforce as a backing store for nearly everything we do now and it contains all our user information. Unfortunately, the force.com API wont let me arbitrarily validate user credentials (which is