title: Oauth 2 - params ordering and signature integrity
body: <p>I have two questions:</p>
  
  <p><strong>Q1:</strong> Why does OAuth2 require params to be ordered and encoded (for 2-legged)?</p>
  
  <p>All it has to worry about is the matching signature in both the end for the given data(query string). </p>
  
  <p>We can just check the signature generated using the query string.(e.g ?a=1&amp;b=2). Since the signature is generated based on the secret key which is known only to the client and provider, we can only consider the query string without any ordering/encoding.</p>
  
  <p>So, what's the advantage in doing ordering/encoding and then creating the signature?</p>
  
  <p><strong>Q2:</strong> How can this signature save me from man-in-the middle attack?</p>
  
  <p>If I have to make a request like this to my server from a client:</p>
  
  <pre><code>increaseUserPoints?userId=1&amp;pointsToAdd=5&amp;appId=x&amp;token=XYZ
  </code></pre>
  
  <p>Now the token XYZ will be always same, so a hacker could keep posting the same request to increase <code>points</code>. Since the generated token from the given <code>appId</code> is the same, the server will allow this. How is this case handled?</p>