Packagenet.oauth
Classpublic class OAuth

The OAuth protocol enables websites or applications (Consumers) to access Protected Resources from a web service (Service Provider) via an API, without requiring Users to disclose their Service Provider credentials to the Consumers. More generally, OAuth creates a freely-implementable and generic methodology for API authentication. References
[NIST] National Institute of Standards and Technolog, NIST., “NIST Brief Comments on Recent Cryptanalytic Attacks on Secure Hashing Functions and the Continued Security Provided by SHA-1.”
[RFC2045] Freed, N. and N. Borenstein, “Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies,” RFC 2045.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, “HMAC: Keyed-Hashing for Message Authentication,” RFC 2104.
[RFC2119] Bradner, B., “Key words for use in RFCs to Indicate Requirement Levels,” RFC 2119.
[RFC2606] Eastlake, D. and A. Panitz, “Reserved Top Level DNS Names,” RFC 2606.
[RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, “Hypertext Transfer Protocol – HTTP/1.1,” RFC 2616.
[RFC2617] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L. Stewart, “HTTP Authentication: Basic and Digest Access Authentication,” RFC 2617.
[RFC3447] Jonsson, J. and B. Kaliski, “Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography; Specifications Version 2.1,” RFC 3447.
[RFC3629] Yergeau, F., “UTF-8, a transformation format of Unicode and ISO 10646,” RFC 3629.
[RFC3986] Berners-Lee, T., “Uniform Resource Identifiers (URI): Generic Syntax,” RFC 3986.
[SHA1] De Canniere, C. and C. Rechberger, “Finding SHA-1 Characteristics: General Results and Applications.”


OAuth协议致力于使网站和应用程序(统称为消费方)能够在无须用户透露其认证证书的情况下, 通过API访问某个web服务(统称为服务提供方)的受保护资源。更一般地说,OAuth为API认证提供了一个可自由实现且通用的方法。

See also

http://oauth.net/core/1.0/


Public Properties
 PropertyDefined by
  auth_signature : String
[read-only] oauth_signature is set to the calculated digest octet string, first base64-encoded per [RFC2045] (Freed, N.
OAuth
  baseRequest : String
OAuth Request URL.
OAuth
  baseRequestURL : String
[read-only] All together, the Consumer request for the photo is:

oauth_consumer_key="dpf43f3p2l4k3l03",
oauth_token="nnch734d00sl2jdk",
oauth_signature_method="HMAC-SHA1",
oauth_signature="tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D",
oauth_timestamp="1191242096",
oauth_nonce="kllo9940pd9333jh",
oauth_version="1.0"

And if using query parameters:
oauth_consumer_key=dpf43f3p2l4k3l03&oauth_token=nnch734d00sl2jdk&oauth_signature_method=HMAC-SHA1&oauth_signature=tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D&oauth_timestamp=1191242096&oauth_nonce=kllo9940pd9333jh&oauth_version=1.0

获取请求URL的基本组成。
OAuth
  baseString : String
The Signature Base String is a consistent reproducible concatenation of the request elements into a single string.
OAuth
  oauth_consumer_key : String
[read-only] A value used by the Consumer to identify itself to the Service Provider.
OAuth
  oauth_consumer_secret_key : String
[read-only] A secret used by the Consumer to establish ownership of the Consumer Key.
OAuth
  oauth_nonce : String
[read-only] A nonce is a random string, uniquely generated for each request.
OAuth
  oauth_signature_method : String
[read-only] The Consumer declares a signature method in the oauth_signature_method parameter, generates a signature, and stores it in the oauth_signature parameter.
OAuth
  oauth_timestamp : String
[read-only] the timestamp is expressed in the number of seconds since January 1, 1970 00:00:00 GMT

获取OAuth timestamp
OAuth
  oauth_token : String
A value used by the Consumer to gain access to the Protected Resources on behalf of the User, instead of using the User’s Service Provider credentials.
OAuth
  oauth_token_secret : String
A secret used by the Consumer to establish ownership of a given Token.
OAuth
  oauth_version : String
OAuth Version.
OAuth
Public Methods
 MethodDefined by
  
OAuth(oauth_consumer_key:String, oauth_consumer_secret_key:String)
OAuth authentication is the process in which Users grant access to their Protected Resources without sharing their credentials with the Consumer.
OAuth
  
getBaseString(method:String, resource:String, baseURL:String = null):String
The Signature Base String is a consistent reproducible concatenation of the request elements into a single string.
OAuth
  
getBaseURL(resource:String):String
OAuth Request URL.
OAuth
  
makeRequest(callBack:Function):void
make request.
OAuth
Property detail
auth_signatureproperty
auth_signature:String  [read-only]

oauth_signature is set to the calculated digest octet string, first base64-encoded per [RFC2045] (Freed, N. and N. Borenstein, “Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies,” .) section 6.8, then URL-encoded per Parameter Encoding (Parameter Encoding).

oauth_signature is set to the concatenated encoded values of the Consumer Secret and Token Secret, separated by a ‘&’ character (ASCII code 38), even if either secret is empty. The result MUST be encoded again.

These examples show the value of oauth_signature for Consumer Secret djr9rjt0jd78jf88 and 3 different Token Secrets:

jjd999tj88uiths3:
oauth_signature=djr9rjt0jd78jf88%26jjd999tj88uiths3
jjd99$tj88uiths3:
oauth_signature=djr9rjt0jd78jf88%26jjd99%2524tj88uiths3
Empty:
oauth_signature=djr9rjt0jd78jf88%26

OAuth签名(默认为HMAC-SHA1算法)。

Implementation
    public function get auth_signature():String
baseRequestproperty 
public var baseRequest:String

OAuth Request URL. All together, the Consumer request for the photo is:
http://photos.example.net/photos?file=vacation.jpg&size=original

Authorization: OAuth realm="http://photos.example.net/",
oauth_consumer_key="dpf43f3p2l4k3l03",
oauth_token="nnch734d00sl2jdk",
oauth_signature_method="HMAC-SHA1",
oauth_signature="tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D",
oauth_timestamp="1191242096",
oauth_nonce="kllo9940pd9333jh",
oauth_version="1.0"

And if using query parameters:
http://photos.example.net/photos?file=vacation.jpg&size=original&oauth_consumer_key=dpf43f3p2l4k3l03&oauth_token=nnch734d00sl2jdk&oauth_signature_method=HMAC-SHA1&oauth_signature=tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D&oauth_timestamp=1191242096&oauth_nonce=kllo9940pd9333jh&oauth_version=1.0

photos.example.net checks the signature and responds with the requested photo.

OAuth 服务终端地址。

baseRequestURLproperty 
baseRequestURL:String  [read-only]

All together, the Consumer request for the photo is:

oauth_consumer_key="dpf43f3p2l4k3l03",
oauth_token="nnch734d00sl2jdk",
oauth_signature_method="HMAC-SHA1",
oauth_signature="tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D",
oauth_timestamp="1191242096",
oauth_nonce="kllo9940pd9333jh",
oauth_version="1.0"

And if using query parameters:
oauth_consumer_key=dpf43f3p2l4k3l03&oauth_token=nnch734d00sl2jdk&oauth_signature_method=HMAC-SHA1&oauth_signature=tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D&oauth_timestamp=1191242096&oauth_nonce=kllo9940pd9333jh&oauth_version=1.0

获取请求URL的基本组成。

Implementation
    public function get baseRequestURL():String
baseStringproperty 
public var baseString:String

The Signature Base String is a consistent reproducible concatenation of the request elements into a single string. The string is used as an input in hashing or signing algorithms. The HMAC-SHA1 signature method provides both a standard and an example of using the Signature Base String with a signing algorithm to generate signatures. All the request parameters MUST be encoded as described in Parameter Encoding (Parameter Encoding) prior to constructing the Signature Base String. To generate the signature, it first needs to generate the Signature Base String. The request contains the following parameters (oauth_signature excluded) which are ordered and concatenated into a normalized string:
oauth_consumer_key:
dpf43f3p2l4k3l03
oauth_token:
nnch734d00sl2jdk
oauth_signature_method:
HMAC-SHA1
oauth_timestamp:
1191242096
oauth_nonce:
kllo9940pd9333jh
oauth_version:
1.0
file:
vacation.jpg
size:
original
The following inputs are used to generate the Signature Base String:
GET
http://photos.example.net/photos
file=vacation.jpg&oauth_consumer_key=dpf43f3p2l4k3l03&oauth_nonce=kllo9940pd9333jh&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1191242096&oauth_token=nnch734d00sl2jdk&oauth_version=1.0&size=original
The Signature Base String is:
GET&http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacation.jpg%26oauth_consumer_key%3Ddpf43f3p2l4k3l03%26oauth_nonce%3Dkllo9940pd9333jh%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1191242096%26oauth_token%3Dnnch734d00sl2jdk%26oauth_version%3D1.0%26size%3Doriginal

oauth_consumer_keyproperty 
oauth_consumer_key:String  [read-only]

A value used by the Consumer to identify itself to the Service Provider.

消费方用来向服务提供方标示身份的值。

Implementation
    public function get oauth_consumer_key():String
oauth_consumer_secret_keyproperty 
oauth_consumer_secret_key:String  [read-only]

A secret used by the Consumer to establish ownership of the Consumer Key.

消费方用于建立对消费方键值所有权的密钥。

Implementation
    public function get oauth_consumer_secret_key():String
oauth_nonceproperty 
oauth_nonce:String  [read-only]

A nonce is a random string, uniquely generated for each request.

获取OAuth Nonce

Implementation
    public function get oauth_nonce():String
oauth_signature_methodproperty 
oauth_signature_method:String  [read-only]

The Consumer declares a signature method in the oauth_signature_method parameter, generates a signature, and stores it in the oauth_signature parameter. The Service Provider verifies the signature as specified in each method. When verifying a Consumer signature, the Service Provider SHOULD check the request nonce to ensure it has not been used in a previous Consumer request.
The signature process MUST NOT change the request parameter names or values, with the exception of the oauth_signature parameter.

加密方法。

Implementation
    public function get oauth_signature_method():String
oauth_timestampproperty 
oauth_timestamp:String  [read-only]

the timestamp is expressed in the number of seconds since January 1, 1970 00:00:00 GMT

获取OAuth timestamp

Implementation
    public function get oauth_timestamp():String
oauth_tokenproperty 
public var oauth_token:String

A value used by the Consumer to gain access to the Protected Resources on behalf of the User, instead of using the User’s Service Provider credentials.

消费方用于代表用户在没有密码的情况下访问受保护资源的值。

oauth_token_secretproperty 
public var oauth_token_secret:String

A secret used by the Consumer to establish ownership of a given Token.

消费方用于建立对特定令牌所有权的密钥。

oauth_versionproperty 
public var oauth_version:String

OAuth Version.

OAuth 版本号。

Constructor detail
OAuth()constructor
public function OAuth(oauth_consumer_key:String, oauth_consumer_secret_key:String)

OAuth authentication is the process in which Users grant access to their Protected Resources without sharing their credentials with the Consumer. OAuth uses Tokens generated by the Service Provider instead of the User’s credentials in Protected Resources requests.

Parameters
oauth_consumer_key:String — The Consumer Key
 
oauth_consumer_secret_key:String — The Consumer Secret

See also

Method detail
getBaseString()method
public function getBaseString(method:String, resource:String, baseURL:String = null):String

The Signature Base String is a consistent reproducible concatenation of the request elements into a single string. The string is used as an input in hashing or signing algorithms. The HMAC-SHA1 signature method provides both a standard and an example of using the Signature Base String with a signing algorithm to generate signatures. All the request parameters MUST be encoded as described in Parameter Encoding (Parameter Encoding) prior to constructing the Signature Base String. To generate the signature, it first needs to generate the Signature Base String. The request contains the following parameters (oauth_signature excluded) which are ordered and concatenated into a normalized string:
oauth_consumer_key:
dpf43f3p2l4k3l03
oauth_token:
nnch734d00sl2jdk
oauth_signature_method:
HMAC-SHA1
oauth_timestamp:
1191242096
oauth_nonce:
kllo9940pd9333jh
oauth_version:
1.0
file:
vacation.jpg
size:
original
The following inputs are used to generate the Signature Base String:
GET
http://photos.example.net/photos
file=vacation.jpg&oauth_consumer_key=dpf43f3p2l4k3l03&oauth_nonce=kllo9940pd9333jh&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1191242096&oauth_token=nnch734d00sl2jdk&oauth_version=1.0&size=original
The Signature Base String is:
GET&http%3A%2F%2Fphotos.example.net%2Fphotos&file%3Dvacation.jpg%26oauth_consumer_key%3Ddpf43f3p2l4k3l03%26oauth_nonce%3Dkllo9940pd9333jh%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1191242096%26oauth_token%3Dnnch734d00sl2jdk%26oauth_version%3D1.0%26size%3Doriginal

Parameters
method:String — HTTP request method.
 
resource:String — Resource URL.
 
baseURL:String (default = null) — the Consumer request.If null, function will use default baseRequestURL.

Returns
String
getBaseURL()method 
public function getBaseURL(resource:String):String

OAuth Request URL. All together, the Consumer request for the photo is:
http://photos.example.net/photos?file=vacation.jpg&size=original

Authorization: OAuth realm="http://photos.example.net/",
oauth_consumer_key="dpf43f3p2l4k3l03",
oauth_token="nnch734d00sl2jdk",
oauth_signature_method="HMAC-SHA1",
oauth_signature="tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D",
oauth_timestamp="1191242096",
oauth_nonce="kllo9940pd9333jh",
oauth_version="1.0"

And if using query parameters:
http://photos.example.net/photos?file=vacation.jpg&size=original&oauth_consumer_key=dpf43f3p2l4k3l03&oauth_token=nnch734d00sl2jdk&oauth_signature_method=HMAC-SHA1&oauth_signature=tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D&oauth_timestamp=1191242096&oauth_nonce=kllo9940pd9333jh&oauth_version=1.0

photos.example.net checks the signature and responds with the requested photo.

Parameters
resource:String — Resource end-point.

Returns
String
makeRequest()method 
public function makeRequest(callBack:Function):void

make request.

Parameters
callBack:Function — callback function when data loaded.

See also