OAuth response invalid_signature - what parameters required to generate signature?

[Kaus Chilweri]

Hi, 

I'm trying to authenticate with OAuth and am having trouble getting an auth token.  I keep getting the following response.

STATUS CODE:
400 Bad Request

DETAILS:
X-Dns-Prefetch-Control: off
X-Frame-Options: DENY
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Surrogate-Control: no-store
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: 0
X-Trello-Version: 1.2317.0
X-Trello-Environment: Production
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, PUT, POST, DELETE
Access-Control-Allow-Headers: Authorization, Accept, Content-Type
Access-Control-Expose-Headers: x-rate-limit-api-key-interval-ms, x-rate-limit-api-key-max, x-rate-limit-api-key-remaining, x-rate-limit-api-token-interval-ms, x-rate-limit-api-token-max, x-rate-limit-api-token-remaining
Content-Type: text/plain; charset=utf-8
Content-Length: 17
Date: Mon, 04 Jan 2021 03:34:24 GMT
X-Envoy-Upstream-Service-Time: 71
Expect-Ct: report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/trello-edge", max-age=86400
Strict-Transport-Security: max-age=63072000; preload
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Server: globaledge-envoy

RETURNED DATA:
Invalid Signature

I'm using a language (AHK) that does NOT have a pre built library for Authorizing with Trello so have built my own.  

I don't see it anywhere specified in the Trello docs as to what parameters will be used to generate the signature that will be checked on Trellos end.  I believe I am using the correct data as laid out in OAuth 1.0 as specified on the developer page . 

The signatutre_base_string I'm generating my signature for is as follows (personal info masked)

GET&https%3A%2F%2Ftrello.com%2F1%2FOAuthGetRequestToken&oauth_callback%3D{CALLBACK_URL}%26oauth_consumer_key%{CONSUMER_KEY_HERE}%26oauth_nonce%3DMjgzNjk3NTcwNDYwNzEzODg3NDIzMjE2Nzg4MzkyNzk%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1609673662%26oauth_version%3D1.0

 which generated the following Authorization Header

(personal info masked and added line breaks for readability)

Authorization: OAuth 
oauth_callback="{CALLBACK_URL}",
oauth_consumer_key="{CONSUMER_KEY_HERE}",
oauth_nonce="MjgzNjk3NTcwNDYwNzEzODg3NDIzMjE2Nzg4MzkyNzk",
oauth_signature="GR7Zk6bT2PaxjYpEzsdVAAi3CCc%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1609673662",
oauth_version="1.0"

 I'm sure that I'm generating the signature correctly as I get the exact same signature when using any of the online HMAC-SHA1 signature generators.

I'm thinking that I might be missing some kind of required parameter that Trello is including when they generate the signature for verification.

Is there any document that lays out exactly what parameters need to be returned for the authorization? or what the header is expected to look like/contain?

Thanks

[Kaus Chilweri · Accepted solution]

I was able to figure out my issue, and hope this might help someone.  

It turns out that I had an error in the generation of my Authorization header, which gave me an different signature than Trello calculated.  I had failed to percent encode my callback url twice.  It needs to be percent encoded when initially adding it to the parameter sting, and then a second time when the entire parameter string is percent encoded.

I was able to figure this out while using the authorization header generator located here.