title: Validating signed requests in C#
body: <p>I'm trying to validate incoming signed requests in my C# server.
  The requests comes from a social platform(naver).
  All I get from them is a certificate(below).</p>
  
  <p>I'm using DevDefinedOAuth</p>
  
  <p><a href="http://code.google.com/p/devdefined-tools/" rel="nofollow">http://code.google.com/p/devdefined-tools/</a></p>
  
  <p>They have a wiki article on this subject.</p>
  
  <p><a href="http://code.google.com/p/devdefined-tools/wiki/OAuthSignatureValidation" rel="nofollow">http://code.google.com/p/devdefined-tools/wiki/OAuthSignatureValidation</a></p>
  
  <p>and Here's my code:</p>
  
  <pre><code>        public static bool isValidRequest2( HttpListenerRequest request )
          {
              X509Certificate2 cert = new X509Certificate2();
              cert.Import( Encoding.ASCII.GetBytes(
  @"-----BEGIN CERTIFICATE-----
  MIICqDCCAhGgAwIBAgIJANDx5Es1s04zMA0GCSqGSIb3DQEBBQUAMG0xCzAJBgNV
  BAYTAktSMQowCAYDVQQIDAEgMQowCAYDVQQHDAEgMQwwCgYDVQQKDANOSE4xEjAQ
  BgNVBAsMCUNvbW11bml0eTESMBAGA1UEAwwJbmF2ZXIuY29tMRAwDgYJKoZIhvcN
  AQkBFgEgMB4XDTEwMDYxNDA1MzAzNVoXDTExMDYxNDA1MzAzNVowbTELMAkGA1UE
  BhMCS1IxCjAIBgNVBAgMASAxCjAIBgNVBAcMASAxDDAKBgNVBAoMA05ITjESMBAG
  A1UECwwJQ29tbXVuaXR5MRIwEAYDVQQDDAluYXZlci5jb20xEDAOBgkqhkiG9w0B
  CQEWASAwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANX++6LgORv6caQ8LCVh
  RYTXi2Lko7zn4wPeqvdCqNZsxcry2mNHn/ic+0XbhNgor5L0l048f0iicW/Qu4vw
  RvkZy2N8dNE3Tb5dbPLNo+S+cExv/DhbQVFKGiOOvr4vQ+2Lgw7If5g3sh6/S8Gu
  ot47cOrUkiLKBKJt614bue9zAgMBAAGjUDBOMB0GA1UdDgQWBBSB1ReDAnl4lRyl
  Rfpl0EZ13E5LzzAfBgNVHSMEGDAWgBSB1ReDAnl4lRylRfpl0EZ13E5LzzAMBgNV
  HRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAEYdZfQjvk/wvlFP4l3mDqS4NMac
  txx1lyYGa0gX4DGhb7aGwBb3qwCdSX7szuYNHHq5Clf9TGQMqc49RFC2TGNRrpSw
  BZFRmyzhMsqx/dLcNIBLfz4B+SUw+yiwNKo3krYCJfqgNy0cW8sF121yWI3tPzqr
  kD8kEbCa5GvxmsdT
  -----END CERTIFICATE-----" ) );
  
              DevDefined.OAuth.Framework.OAuthContext context = new DevDefined.OAuth.Framework.OAuthContext
              {
                //RawUri = request.Url,
                RawUri = CleanUri( request.Url ),
                Cookies = new NameValueCollection(),
                Headers = request.Headers,
                RequestMethod = request.HttpMethod,
                FormEncodedParameters = new NameValueCollection(),
                QueryParameters = new NameValueCollection( request.QueryString )
              };
              // do I need to set them manually?.. let's try..
              context.ConsumerKey = request.QueryString[ "oauth_consumer_key" ];
              context.Timestamp = request.QueryString[ "oauth_timestamp" ];
              context.Nonce = request.QueryString[ "oauth_nonce" ];
              context.Signature = request.QueryString[ "oauth_signature" ];
  
              var signer = new DevDefined.OAuth.Framework.Signing.OAuthContextSigner();
  
              DevDefined.OAuth.Framework.SigningContext signingContext = new DevDefined.OAuth.Framework.SigningContext();
  
              // use context.ConsumerKey to fetch information required for signature validation for this consumer.
  
              signingContext.Algorithm = cert.PublicKey.Key;
              //signingContext.ConsumerSecret; // if there is a consumer secret
  
              return ( signer.ValidateSignature( context, signingContext ) );
          }
  </code></pre>
  
  <p>And here's a sample request: (<em>I <strong>changed the url a bit for security reasons</em></strong>)</p>
  
  <ul>
  <li><p>Url: <a href="http://www.maxmax.co.cc:7677/?oauth_signature=b58RqdQ0Atnrvvy6Qi81BRv1fhmXIQEl3hY++Wi7kiinSOhWq7mluhsapEi/GvCUG6RjrYVowwTcoi" rel="nofollow">http://www.maxmax.co.cc:7677/?oauth_signature=b58RqdQ0Atnrvvy6Qi81BRv1fhmXIQEl3hY++Wi7kiinSOhWq7mluhsapEi/GvCUG6RjrYVowwTcoi</a> MqqmVCasFlON7zU7Yyi8nOUAoClpoft0BXbT5xyNUmLOxTk47tmjWVMLniaOieVUEQLwP2yycH6hiWkf2gFWGsu9LHZbE=&amp;oauth_nonce=14611349243983507&amp;oauth _version=1.0&amp;oauth_body_hash=2jmj7l5rSw0yVb/vlWAYkK/YBwk=&amp;oauth_signature_method=RSA-SHA1&amp;oauth_consumer_key=naver.com&amp;xoauth_sign ature_publickey=http://nsocialcontainer.com/server/naver_socialapp_public.cer&amp;xoauth_public_key=http://nsocialcontainer.com/server /naver_socialapp_public.cer&amp;opensocial_owner_id=1400000000010946792&amp;opensocial_app_id=25992&amp;oauth_timestamp=1296334075</p></li>
  <li><p>HttpMethod: GET</p></li>
  <li><p>UserAgent: Jakarta Commons-HttpClient/3.1</p></li>
  <li><p>QueryString </p>
  
  <ul>
  <li>oauth_signature:b58RqdQ0Atnrvvy6Qi81BRv1fhmXIQEl3hY++Wi7kiinSOhWq7mluhsapEi/GvCUG6RjrYVowwTcoiMqqmVCasFlON7zU7Yyi8nOUAoClpoft0BX bT5xyNUmLOxTk47tmjWVMLniaOieVUEQLwP2yycH6hiWkf2gFWGsu9LHZbE= </li>
  <li>oauth_nonce:14611349243983507 - oauth_version:1.0 </li>
  <li>oauth_body_hash:2jmj7l5rSw0yVb/vlWAYkK/YBwk= </li>
  <li>oauth_signature_method:RSA-SHA1 </li>
  <li>oauth_consumer_key:naver.com </li>
  <li>xoauth_signature_publickey:http://nsocialcontainer.com/server/naver_socialapp_public.cer </li>
  <li>xoauth_public_key:http://nsocialcontainer.com/server/naver_socialapp_public.cer </li>
  <li>opensocial_owner_id:1400000000010946792 </li>
  <li>opensocial_app_id:25992 </li>
  <li>oauth_timestamp:1296334075</li>
  </ul></li>
  <li><p>Headers </p>
  
  <ul>
  <li>X-Forwarded-For:61.75.38.242 </li>
  <li>X-shindig-dos:on - Accept-Encoding:gzip, deflate </li>
  <li>Host:www.maxmax.co.cc:7677</li>
  </ul></li>
  <li>body: ""</li>
  </ul>
  
  <p>I get no error messages, no exceptions, but isValidRequest2() always returns 'false'
  even with valid requests.</p>
  
  <p>I must be using it wrong.
  Any help will be greatly appreciated!!
  If you have any questions on this question, please ask.</p>
  
  <p>Thanks!!!!</p>