Page Comparison

function makeSignedRequest() {

   var params = {};

   params[gadgets.io.RequestParameters.AUTHORIZATION] = gadgets.io.AuthorizationType.SIGNED;

   params[gadgets.io.RequestParameters.CONTENT_TYPE] = gadgets.io.ContentType.JSON;

   var url = "http://graargh.returnstrue.com/buh/fetchme.php";

   gadgets.io.makeRequest(url, response, params);

 };

 
 function response(ret) {

   output(ret.data);

 
   var html = [ ret.data.validated, "

<br />",

     "oauth_consumer_key: ", ret.data.query.oauth_consumer_key, "

<br />",

     "oauth_nonce: ", ret.data.query.oauth_nonce, "

<br />",

     "oauth_signature: ", ret.data.query.oauth_signature, "

<br />",

     "oauth_signature_method: ", ret.data.query.oauth_signature_method, "

<br />",

     "oauth_timestamp: ", ret.data.query.oauth_timestamp, "

<br />",

     "oauth_token: ", ret.data.query.oauth_token, "

<br />",

     "opensocial_appid: ", ret.data.query.opensocial_appid, "

<br />",

     "opensocial_ownerid: ", ret.data.query.opensocial_ownerid, "

<br />",

     "xoauth_signature_publickey: ", ret.data.query.xoauth_signature_publickey ].join("");

 
   output(html);

};

<?php

   require_once("OAuth.php");

 
   class OrkutSignatureMethod extends OAuthSignatureMethod_RSA_SHA1

 {
     protected function fetch_public_cert(&$request)

 {
       return <<<EOD
 -----BEGIN CERTIFICATE-----

 MIIDHDCCAoWgAwIBAgIJAMbTCksqLiWeMA0GCSqGSIb3DQEBBQUAMGgxCzAJBgNV

 BAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIG

 A1UEChMLR29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVscnlh

 bjAeFw0wODAxMDgxOTE1MjdaFw0wOTAxMDcxOTE1MjdaMGgxCzAJBgNVBAYTAlVT

 MQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChML

 R29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVscnlhbjCBnzAN

 BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAseBXZ4NDhm24nX3sJRiZJhvy9eDZX12G

 j4HWAMmhAcnm2iBgYpAigwhVHtOs+ZIUIdzQHvHeNd0ydc1Jg8e+C+Mlzo38OvaG

 D3qwvzJ0LNn7L80c0XVrvEALdD9zrO+0XSZpTK9PJrl2W59lZlJFUk3pV+jFR8NY

 eB/fto7AVtECAwEAAaOBzTCByjAdBgNVHQ4EFgQUv7TZGZaI+FifzjpTVjtPHSvb

 XqUwgZoGA1UdIwSBkjCBj4AUv7TZGZaI+FifzjpTVjtPHSvbXqWhbKRqMGgxCzAJ

 BgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEU

 MBIGA1UEChMLR29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVs

 cnlhboIJAMbTCksqLiWeMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEA

 CETnhlEnCJVDXoEtSSwUBLP/147sqiu9a4TNqchTHJObwTwDPUMaU6XIs2OTMmFu

 GeIYpkHXzTa9Q6IKlc7Bt2xkSeY3siRWCxvZekMxPvv7YTcnaVlZzHrVfAzqNsTG

 P3J//C0j+8JWg6G+zuo5k7pNRKDY76GxxHPYamdLfwk=

 -----END CERTIFICATE-----

 EOD;

     }
   }
 
   //Build a request object from the current request

   $request = OAuthRequest::from_request(null, null, array_merge($_GET, $_POST));

 
   //Initialize the new signature method

   $signature_method = new OrkutSignatureMethod();

 
   //Check the request signature

   @$signature_valid = $signature_method->check_signature($request, null, null, $_GET["oauth_signature"]);

 
   //Build the output object

   $payload = array();

   if ($signature_valid

 == true)

 {
     $payload["validated"] = "Success! The data was validated";

   } else

 {
     $payload["validated"] = "This request was spoofed";

   }
 
   //Add extra parameters to help debugging

   $payload["query"] = array_merge($_GET, $_POST);

   $payload["rawpost"] = file_get_contents("php://input");

 
   //Return the response as JSON

   print(json_encode($payload));

{ "validated" : "Success! The data was validated",

   "query" : { <all of the parameters passed in the query> }

{ "validated" : "This request was spoofed",

   "query" : { <all of the parameters passed in the query> }

 
 import net.oauth.OAuth;

 import net.oauth.OAuthAccessor;

 import net.oauth.OAuthConsumer;

 import net.oauth.OAuthMessage;

 import net.oauth.OAuthProblemException;

 import net.oauth.OAuthServiceProvider;

 import net.oauth.OAuthValidator;

 import net.oauth.SimpleOAuthValidator;

 import net.oauth.server.OAuthServlet;

 import net.oauth.signature.RSA_SHA1;

 
 import java.util.ArrayList;

 import java.io.IOException;

 import java.util.Map;

 import java.io.PrintWriter;

 import java.util.List;

 
 import javax.servlet.ServletException;

 import javax.servlet.http.HttpServlet;

 import javax.servlet.http.HttpServletRequest;

 import javax.servlet.http.HttpServletResponse;

 
 public class SignedFetchVerifyServlet extends HttpServlet

 {
 
   private final static String CERTIFICATE =
       "-----BEGIN CERTIFICATE-----\n"

           + "MIIDHDCCAoWgAwIBAgIJAMbTCksqLiWeMA0GCSqGSIb3DQEBBQUAMGgxCzAJBgNV\n"

           + "BAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIG\n"

           + "A1UEChMLR29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVscnlh\n"

           + "bjAeFw0wODAxMDgxOTE1MjdaFw0wOTAxMDcxOTE1MjdaMGgxCzAJBgNVBAYTAlVT\n"

           + "MQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChML\n"
           + "R29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVscnlhbjCBnzAN\n"

           + "BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAseBXZ4NDhm24nX3sJRiZJhvy9eDZX12G\n"

           + "j4HWAMmhAcnm2iBgYpAigwhVHtOs+ZIUIdzQHvHeNd0ydc1Jg8e+C+Mlzo38OvaG\n"

           + "D3qwvzJ0LNn7L80c0XVrvEALdD9zrO+0XSZpTK9PJrl2W59lZlJFUk3pV+jFR8NY\n"

           + "eB/fto7AVtECAwEAAaOBzTCByjAdBgNVHQ4EFgQUv7TZGZaI+FifzjpTVjtPHSvb\n"

           + "XqUwgZoGA1UdIwSBkjCBj4AUv7TZGZaI+FifzjpTVjtPHSvbXqWhbKRqMGgxCzAJ\n"

           + "BgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEU\n"

           + "MBIGA1UEChMLR29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVs\n"

           + "cnlhboIJAMbTCksqLiWeMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEA\n"

           + "CETnhlEnCJVDXoEtSSwUBLP/147sqiu9a4TNqchTHJObwTwDPUMaU6XIs2OTMmFu\n"

           + "GeIYpkHXzTa9Q6IKlc7Bt2xkSeY3siRWCxvZekMxPvv7YTcnaVlZzHrVfAzqNsTG\n"

           + "P3J//C0j+8JWg6G+zuo5k7pNRKDY76GxxHPYamdLfwk=\n"

           + "-----END CERTIFICATE-----";

 
   @Override
   protected void doGet(HttpServletRequest req, HttpServletResponse resp)

       throws ServletException, IOException

 {
     verifyFetch(req, resp);

   }
 
 
   @Override
   protected void doPost(HttpServletRequest req, HttpServletResponse resp)

       throws ServletException, IOException

 {
     verifyFetch(req, resp);

   }
 
 
   private void verifyFetch(HttpServletRequest request, HttpServletResponse resp)

       throws IOException, ServletException

 {
     resp.setContentType("text/html; charset=UTF-8");

     PrintWriter out = resp.getWriter();

 
     try {
       OAuthServiceProvider provider =
           new OAuthServiceProvider(null, null, null);

       OAuthConsumer consumer =
           new OAuthConsumer(null, "orkut.com", null, provider);

       consumer.setProperty(RSA_SHA1.X509_CERTIFICATE, CERTIFICATE);

 
       String method = request.getMethod();

       String requestUrl = getRequestUrl(request);

       List<OAuth.Parameter> requestParameters = getRequestParameters(request);

 
       OAuthMessage message =
           new OAuthMessage(method, requestUrl, requestParameters);

       out.print("*** OAuthMessage Params:");

       out.print("

       for (java.util.Map.Entry param : message.getParameters())

 {
         String key = param.getKey().toString();

         String value = param.getValue().toString();

         out.print("

<br>");

         out.print("Param Name-->" + OAuthServlet.htmlEncode(key));

         out.print("

 ");

         out.print("Value-->" + OAuthServlet.htmlEncode(value));

       }
       out.print("

<br>");

       out.print(" VALIDATING SIGNATURE ");

       out.print("

<br>");

       message.validateMessage( accessor, new SimpleOAuthValidator());

       out.print("REQUEST STATUS::OK");

       out.print("

<br>");

     } catch (OAuthProblemException ope)

 {
       out.print("

<br>");

       out.print("OAuthProblemException-->"

           + OAuthServlet.htmlEncode(ope.getProblem()));

      } catch (Exception e)

 {
     	 out.println(e);

     	 System.out.println(e);

       throw new ServletException(e);

     } finally {
       out.flush();

   
     }
   }
 
   /**
     * Constructs and returns the full URL associated with the passed request
     * object.
     * 
     * @param  request Servlet request object with methods for retrieving the
     *         various components of the request URL
     */
   public static String getRequestUrl(HttpServletRequest request) {
     StringBuilder requestUrl = new StringBuilder();
     String scheme = request.getScheme();
     int port = request.getLocalPort();
 
     requestUrl.append(scheme);

     requestUrl.append("://");

     requestUrl.append(request.getServerName());

             || (scheme.equals("https") && port != 443))

 {
       requestUrl.append(":");

       requestUrl.append(port);

     }
 
     requestUrl.append(request.getContextPath());

     requestUrl.append(request.getServletPath());

}

   }
 
   /**
    * Constructs and returns a List of OAuth.Parameter objects, one per
    * parameter in the passed request.
    * 
    * @param  request Servlet request object with methods for retrieving the
    *         full set of parameters passed with the request
    */
   public static List<OAuth.Parameter> getRequestParameters(
       HttpServletRequest request) {
 
     List<OAuth.Parameter> parameters = new ArrayList<OAuth.Parameter>();
 
     for (Object e : request.getParameterMap().entrySet())

 {
       Map.Entry<String,

 String[]> entry = (Map.

Entry<String, String

[]>) e;

 {
         parameters.add(new OAuth.Parameter(entry.getKey(), value));

}
}

*** OAuthMessage Params:

URL: http://oauthtest.s42.eatj.com/oauth/SignedFetchVerifyServlet

Param Name-->oauth_consumer_key Value-->orkut.com

Param Name-->oauth_nonce Value-->7fe2ce6b24e17c86

Param Name-->opensocial_app_id Value-->10449685582340194994

Param Name-->opensocial_viewer_id Value-->10972140642666904206

Param Name-->oauth_timestamp Value-->1211519778

Param Name-->opensocial_owner_id Value-->10972140642666904206

Param Name-->oauth_signature Value-->eYwX2yWLpOZ+gb5oEFeIy+EM3j237nrj/1rj3yp69jgo

                                     /QaPk/OnXbXP9imEcERxtQLj9QqDD8cjbjMJ46VINc7b
                                     Lab8qER1Xhkf4tTIkwfFXJW9tjQMBuGO8OVf9v0UAjAr
                                     uWfSN331LLgGFecKQR5UTD0qAAyzTnFY9aSmqg8=
Param Name-->xoauth_signature_publickey Value-->pub.1199819524.-1556113204990931254.cer
Param Name-->oauth_token Value-->
Param Name-->oauth_signature_method Value-->RSA-SHA1
VALIDATING SIGNATURE
REQUEST STATUS::OK

 {
   var params = {};

   params[gadgets.io.RequestParameters.AUTHORIZATION] = gadgets.io.AuthorizationType.SIGNED;

   params[gadgets.io.RequestParameters.CONTENT_TYPE] = gadgets.io.ContentType.JSON;

   var url = "http://opensocial.dachary.org/cgi-bin/fetchme.py";

   gadgets.io.makeRequest(url, response, params);

 };

 
 function response(ret)

 {
   if(window.console && window.console.log)

      window.console.log("ret = " + JSON.stringify(ret));

     "<b>opensocial_app_id</b>: ", ret.data.query.opensocial_app_id, "</li>\n<li>",

     "<b>opensocial_owner_id</b>: ", ret.data.query.opensocial_owner_id, "</li>\n<li>",

     "<b>opensocial_viewer_id</b>: ", ret.data.query.opensocial_viewer_id, "</li>\n<li>",

     "<b>oauth_consumer_key</b>: ", ret.data.query.oauth_consumer_key, "</li>\n<li>",

     "<b>oauth_nonce</b>: ", ret.data.query.oauth_nonce, "</li>\n<li>",

     "<b>oauth_signature</b>: ", ret.data.query.oauth_signature, "</li>\n<li>",

     "<b>oauth_signature_method</b>: ", ret.data.query.oauth_signature_method, "</li>\n<li>",

     "<b>oauth_timestamp</b>: ", ret.data.query.oauth_timestamp, "</li>\n<li>",

     "<b>oauth_token</b>: ", ret.data.query.oauth_token, "</li>\n<li>",

     "<b>xoauth_signature_publickey</b>: ", ret.data.query.xoauth_signature_publickey, "</li></ul></font>" ].join("");

 
   document.getElementById('console').innerHTML = html;

 
 };

 
 makeSignedRequest();

          </script>

          <div id="console">...loading...</div>

     ]]>

  </Content>

</Module>

 {
    'http://modules.partuza.nl/public.cer': partuza_hex_cert,

    'http://shindig.opensocial.dachary.org/public.cer': dachary_hex_cert

}

    hex_cert = url2cert[cert_url

:]
 
    if local_hash

 == remote_hash:

        info['validated'] = 'verified '

    else:

        info['validated'] = 'not verified '

else:

    info['validated'] = cert_url + ' is not among the known cert urls (' + str(url2cert.keys()) + ') '

info['validated'] +=  raw + ' from URL ' + url

{
  HttpContext htp;
  public oBasePage(HttpContext _htp)

  {
    htp = _htp;

  {
    //If you want to import certificate file directly then uncomment the below line and comment the certificate

    //X509Certificate Cert = X509Certificate.CreateFromCertFile(htp.Request.PhysicalApplicationPath + "/bin/pub.1199819524.-1556113204990931254.cer");

    cert.Import(Encoding.ASCII.GetBytes(

        @"-----BEGIN CERTIFICATE-----

        MIIDHDCCAoWgAwIBAgIJAMbTCksqLiWeMA0GCSqGSIb3DQEBBQUAMGgxCzAJBgNV
        BAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIG
        A1UEChMLR29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVscnlh
        bjAeFw0wODAxMDgxOTE1MjdaFw0wOTAxMDcxOTE1MjdaMGgxCzAJBgNVBAYTAlVT
        MQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChML
        R29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVscnlhbjCBnzAN
        BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAseBXZ4NDhm24nX3sJRiZJhvy9eDZX12G
        j4HWAMmhAcnm2iBgYpAigwhVHtOs+ZIUIdzQHvHeNd0ydc1Jg8e+C+Mlzo38OvaG
        D3qwvzJ0LNn7L80c0XVrvEALdD9zrO+0XSZpTK9PJrl2W59lZlJFUk3pV+jFR8NY
        eB/fto7AVtECAwEAAaOBzTCByjAdBgNVHQ4EFgQUv7TZGZaI+FifzjpTVjtPHSvb
        XqUwgZoGA1UdIwSBkjCBj4AUv7TZGZaI+FifzjpTVjtPHSvbXqWhbKRqMGgxCzAJ
        BgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEU
        MBIGA1UEChMLR29vZ2xlIEluYy4xDjAMBgNVBAsTBU9ya3V0MQ4wDAYDVQQDEwVs
        cnlhboIJAMbTCksqLiWeMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEA
        CETnhlEnCJVDXoEtSSwUBLP/147sqiu9a4TNqchTHJObwTwDPUMaU6XIs2OTMmFu
        GeIYpkHXzTa9Q6IKlc7Bt2xkSeY3siRWCxvZekMxPvv7YTcnaVlZzHrVfAzqNsTG
        P3J//C0j+8JWg6G+zuo5k7pNRKDY76GxxHPYamdLfwk=

        -----END CERTIFICATE-----"));

 
    //Getting Post

 variables
    string http_params;

    NameValueCollection _p = htp.Request.Form;

    Hashtable _hp = new Hashtable();

{
if (k != null)
{
_hpk = _pk;
}
}

 
    string[] pairs1 = new string[_ps.Count];

    int l = 0;

    {
      pairs1[l++] = name + "=" + Uri.EscapeDataString(_ps[name].ToString());

    }
    http_params = String.Join("&", pairs1);

    {
      http_params = "&" + http_params;

    }
 
    /* RSACryptoServiceProvider Provider = CertUtil.GetCertPublicKey(Cert); // if importing the file directly...

RSACryptoServiceProvider Provider = (RSACryptoServiceProvider)cert.PublicKey.Key;
OAuth.OAuthBase ba = new OAuthBase();

string baseString = ba.GenerateSignatureBase(htp.Request.Url,
htp.Request.QueryString"oauth_consumer_key",
"",
htp.Request.QueryString"oauth_token",
"",
htp.Request.HttpMethod,
htp.Request.QueryString"oauth_timestamp",
htp.Request.QueryString"oauth_nonce",
"RSA-SHA1",
http_params);

 */
    RSACryptoServiceProvider Provider = (RSACryptoServiceProvider)cert.PublicKey.Key;
    OAuth.OAuthBase ba = new OAuthBase();
 
    string signature = htp.Request.QueryString["oauth_signature"];
 
    string baseString = ba.GenerateSignatureBase(htp.Request.Url,
                                                 htp.Request.QueryString["oauth_consumer_key"],
                                                 "",
                                                 htp.Request.QueryString["oauth_token"],
                                                 "",
                                                 htp.Request.HttpMethod,
                                                 htp.Request.QueryString["oauth_timestamp"],
                                                 htp.Request.QueryString["oauth_nonce"],
                                                 "RSA-SHA1",
                                                 http_params);
 
    byte[] sign = Convert.FromBase64String(signature);
    byte[] bstring = Encoding.UTF8.GetBytes(baseString);

    htp.Response.Write(htp.Request.QueryString["oauth_token"]);

 
    return Provider.VerifyData(bstring, "SHA1", sign);

  }

}