Getting Invalid Signature for trello OAuthGetRequestToken. How to fix?

[AravindhanSundaram]

Hi,
Are there any recent changes in OAuthGetRequestToken? It was working fine for months, but suddenly I am getting (400 - Invalid Signature) this error.

Request Url:

https://trello.com/1/OAuthGetRequestToken?scope=r+e+a+d+%2C+w+r+i+t+e&oauth_callback=http%3A%2F%2Flocalhost%3A8000%2Faccounts%2Ftrello%2Flogin%2Fcallback%2F

Method: POST

Params:
(personal info masked and added line breaks for readability)

Authorization: OAuth 1.0
oauth_callback="http://localhost:8000/accounts/trello/login/callback/",
oauth_consumer_key="ed35XXXXXXXXXXXXXXXXXXXXXc12b",
oauth_nonce="a30vQMPpr4w",
oauth_signature="a3Qh3D4KvI43NwvZmgjc%2FkrTrr0%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1665735825",
oauth_version="1.0"

Request Headers:

{

'Date': 'Fri, 14 Oct 2022 08:32:06 GMT', 

'Content-Type': 'text/plain; charset=utf-8', 

'Content-Length': '17', 

'X-Dns-Prefetch-Control': 'off', 

'X-Frame-Options': 'DENY', 

'X-Download-Options': 'noopen', 

'X-Permitted-Cross-Domain-Policies': 'none', 

'Referrer-Policy': 'strict-origin-when-cross-origin', 

'Surrogate-Control': 'no-store', 

'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate', 

'Pragma': 'no-cache', 

'Expires': '0', 

'X-Trello-Version': '1.163591.0', 

'X-Trello-Environment': 'Production (Micros)', 

'Access-Control-Allow-Origin': '*', 

'Access-Control-Allow-Methods': 'GET, PUT, POST, DELETE', 

'Access-Control-Allow-Headers': 'Authorization, Accept, Content-Type', 

'Access-Control-Expose-Headers': 'x-rate-limit-api-key-interval-ms, x-rate-limit-api-key-max, x-rate-limit-api-key-remaining, x-rate-limit-api-token-interval-ms, x-rate-limit-api-token-max, x-rate-limit-api-token-remaining', 

'X-Envoy-Upstream-Service-Time': '219', 

'Server': 'globaledge-envoy', 

'Expect-Ct': 'report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/trello-edge", max-age=86400', 

'Strict-Transport-Security': 'max-age=63072000; preload', 

'X-Content-Type-Options': 'nosniff', 

'X-Xss-Protection': '1; mode=block', 

'Atl-Traceid': '8dd9c171c70391a3', 

'Report-To': '{

 "endpoints": [

 {"url": "https://dz8aopenkvv6s.cloudfront.net"}

 ], 

 "group": "endpoint-1", 

 "include_subdomains": true, "max_age": 600

 }', 

'Nel': '{

 "failure_fraction": 0.001, 

 "include_subdomains": true, 

 "max_age": 600, 

 "report_to": "endpoint-1"

 }'

} 

Status Code:  400 Bad Request

Response Text: Invalid Signature

I am using django-allauth library for Authorizing with Trello, which was working fine. Recently, I am getting "400 - invalid signature". I tested using postman, same result.

I'm thinking that I might be missing some kind of required parameter that Trello is included recently when they generate the signature for verification.

Is there any document that lays out exactly what parameters need to be returned for the authorization? or what the header is expected to look like/contain?

Thanks

[Alex Waite]

Duplicate of https://community.atlassian.com/t5/Trello-questions/Getting-Invalid-Signature-error-for-OAuthGetRequestToken-How-to/qaq-p/2162933