title: Calculating an oauth signature
body: <p>I am trying something a little specific, namely trying to call a REST API. I have been following these <a href="http://platform.fatsecret.com/api/Default.aspx?screen=rapiauth#create_signature_base" rel="nofollow noreferrer">instructions</a>.</p>
  <p>I have been very careful to ensure that I am creating the &quot;Signature base string&quot; correctly. They define it to be created like this:</p>
  <blockquote>
  <p>(HTTP Method)&amp;(Request URL)&amp;(Normalized Parameters)</p>
  </blockquote>
  <p>You can double check if need be in my code, but I am very sure that it is fine.</p>
  <p>The problem that I am having is creating what they call the &quot;oauth signature&quot; and mine isn't matching theirs. They it should be created like this:</p>
  <blockquote>
  <p>Use the HMAC-SHA1 signature algorithm as defined by the [RFC2104] to sign the request where text is the Signature Base String and key is the concatenated values of the Consumer Secret and Access Secret separated by an '&amp;' character (show '&amp;' even if Access Secret is empty as some methods do not require an Access Token).</p>
  <p>The calculated digest octet string, first base64-encoded per [RFC2045], then escaped using the [RFC3986] percent-encoding (%xx) mechanism is the oauth_signature.</p>
  </blockquote>
  <p>I express this in my code like so:</p>
  <pre><code>var oauthSignature = CryptoJS.HmacSHA1(signatureBaseString, sharedSecret+&quot;&amp;&quot;);
  var oauthSignature64 = encodeURIComponent(CryptoJS.enc.Base64.stringify(oauthSignature));
  console.log(&quot;hash in 64: &quot; + oauthSignature64);
  </code></pre>
  <p>I am using Google's CryptoJS library. I take the signature base string as the text, I then take my consumer secret as the key concatenated with &quot;&amp;&quot;, I have no Access key and it isn't required but that is OK. I then base 64 encode the result of that hash, after which I URI encode it, please could some guys sanity check my understanding of that and my usage/expressing of it in code using this library, I think this is where my problem is.</p>
  <p>Here is my full code:</p>
  <pre><code>var fatSecretRestUrl = &quot;http://platform.fatsecret.com/rest/server.api&quot;;
  
  var d = new Date();
  var sharedSecret = &quot;xxxx&quot;;
  var consumerKey = &quot;xxxx&quot;;
  
  //this is yet another test tyring to make this thing work
  var baseUrl = &quot;http://platform.fatsecret.com/rest/server.api?&quot;;
  var parameters = &quot;method=food.search&amp;oauth_consumer_key=&quot;+consumerKey+&quot;&amp;oauth_nonce=123&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_timestamp=&quot;+getTimeInSeconds()+&quot;&amp;oauth_version=1.0&amp;search_expression=banana&quot;;
  var signatureBaseString = &quot;POST&amp;&quot; + encodeURIComponent(baseUrl) + &quot;&amp;&quot; + encodeURIComponent(parameters);
  console.log(&quot;signature base string: &quot; + signatureBaseString);
  var oauthSignature = CryptoJS.HmacSHA1(signatureBaseString, sharedSecret+&quot;&amp;&quot;);
  var oauthSignature64 = encodeURIComponent(CryptoJS.enc.Base64.stringify(oauthSignature));
  console.log(&quot;hash in 64: &quot; + oauthSignature64);
  
  var testUrl = baseUrl+&quot;method=food.search&amp;oauth_consumer_key=xxxx&amp;oauth_nonce=123&amp;oauth_signature=&quot;+oauthSignature64+&quot;&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_timestamp=&quot;+getTimeInSeconds()+&quot;&amp;oauth_version=1.0&amp;search_expression=banana&quot;;
  console.log(&quot;final URL: &quot; + testUrl);
  
  var request = $http({
    method :&quot;POST&quot;,
    url: testUrl
  });
  </code></pre>
  <p>I have taken care to ensure that the parameters that I am posting are in lexicographical order and I am very sure that it is correct.</p>
  <p>The response that I am getting back is:</p>
  <blockquote>
  <p>Invalid signature: oauth_signature 'RWeFME4w2Obzn2x50xsXujAs1yI='</p>
  </blockquote>
  <p>So clearly either</p>
  <ol>
  <li>I haven't understood the instructions provided in the API</li>
  <li>Or I have understood them but I haven't expressed them in that way in my code</li>
  <li>Or both of the above</li>
  <li>Or I have made some subtle mistake somewhere that I can't see</li>
  </ol>
  <p>I would really appreciate a sanity check, this has taken a while.</p>