Getting Invalid Signature error for OAuthGetRequestToken - How to fix?

[AravindhanSundaram]

Hi,
Are there any recent changes in OAuthGetRequestToken? It was working fine for months, but suddenly I am getting (400 - Invalid Signature) this error.

Request Url:

https://trello.com/1/OAuthGetRequestToken?scope=r+e+a+d+%2C+w+r+i+t+e&oauth_callback=http%3A%2F%2Flocalhost%3A8000%2Faccounts%2Ftrello%2Flogin%2Fcallback%2F

Method: POST

Params:
(personal info masked and added line breaks for readability)

Authorization: OAuth 1.0
oauth_callback="http://localhost:8000/accounts/trello/login/callback/",
oauth_consumer_key="ed35XXXXXXXXXXXXXXXXXXXXXc12b",
oauth_nonce="a30vQMPpr4w",
oauth_signature="a3Qh3D4KvI43NwvZmgjc%2FkrTrr0%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1665735825",
oauth_version="1.0"

Request Headers:

{

'Date': 'Fri, 14 Oct 2022 08:32:06 GMT', 

'Content-Type': 'text/plain; charset=utf-8', 

'Content-Length': '17', 

'X-Dns-Prefetch-Control': 'off', 

'X-Frame-Options': 'DENY', 

'X-Download-Options': 'noopen', 

'X-Permitted-Cross-Domain-Policies': 'none', 

'Referrer-Policy': 'strict-origin-when-cross-origin', 

'Surrogate-Control': 'no-store', 

'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate', 

'Pragma': 'no-cache', 

'Expires': '0', 

'X-Trello-Version': '1.163591.0', 

'X-Trello-Environment': 'Production (Micros)', 

'Access-Control-Allow-Origin': '*', 

'Access-Control-Allow-Methods': 'GET, PUT, POST, DELETE', 

'Access-Control-Allow-Headers': 'Authorization, Accept, Content-Type', 

'Access-Control-Expose-Headers': 'x-rate-limit-api-key-interval-ms, x-rate-limit-api-key-max, x-rate-limit-api-key-remaining, x-rate-limit-api-token-interval-ms, x-rate-limit-api-token-max, x-rate-limit-api-token-remaining', 

'X-Envoy-Upstream-Service-Time': '219', 

'Server': 'globaledge-envoy', 

'Expect-Ct': 'report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/trello-edge", max-age=86400', 

'Strict-Transport-Security': 'max-age=63072000; preload', 

'X-Content-Type-Options': 'nosniff', 

'X-Xss-Protection': '1; mode=block', 

'Atl-Traceid': '8dd9c171c70391a3', 

'Report-To': '{

 "endpoints": [

 {"url": "https://dz8aopenkvv6s.cloudfront.net"}

 ], 

 "group": "endpoint-1", 

 "include_subdomains": true, "max_age": 600

 }', 

'Nel': '{

 "failure_fraction": 0.001, 

 "include_subdomains": true, 

 "max_age": 600, 

 "report_to": "endpoint-1"

 }'

} 

Status Code:  400 Bad Request

Response Text: Invalid Signature

I am using django-allauth library for Authorizing with Trello, which was working fine. Recently, I am getting "400 - invalid signature". I tested using postman, same result.

I'm thinking that I might be missing some kind of required parameter that Trello is included recently when they generate the signature for verification.

Is there any document that lays out exactly what parameters need to be returned for the authorization? or what the header is expected to look like/contain?

Thanks

[Alex Waite]

Hey @AravindhanSundaram - I recommend raising this at https://community.developer.atlassian.com/c/trello/42 - they'll be better suited to assist you with this. 

[AravindhanSundaram]

Hi @Alex Waite

Thank you for the recommendation. I will post there.