OAuth Request Signer

Build a simple OAuth 1.0 request signing utility that generates HMAC-SHA1 signatures for authenticating HTTP requests.

Requirements

Your utility should sign HTTP requests according to OAuth 1.0 specifications. It must:

1. Accept the HTTP method (GET, POST, etc.), the base URL, and OAuth parameters
2. Accept the consumer secret and token secret as credentials
3. Generate a cryptographically secure signature using HMAC-SHA1
4. Return the base64-encoded signature string

The signature should be compatible with standard OAuth 1.0 providers that use HMAC-SHA1 authentication.

Constraints

• Handle parameters as JavaScript objects with string keys and values
• Support empty or missing token secrets (common during initial request token phase)
• Ensure proper encoding of all parameters and secrets
• Return signatures in base64 format

Test Cases

• Signing a GET request to "https://api.example.com/users" with parameters {oauth_consumer_key: "key123", oauth_nonce: "random", oauth_timestamp: "1234567890"}, consumer secret "secret", and empty token secret produces a valid base64-encoded signature @test

• Signing a POST request to "https://api.example.com/status" with parameters {status: "hello world", oauth_consumer_key: "key456"}, consumer secret "consumer_sec", and token secret "token_sec" produces a different signature than the GET request @test

• Signing requests with the same parameters but different secrets produces different signatures @test

• Signing requests with Unicode characters in parameters (e.g., {message: "Hello 世界"}) produces a valid signature @test

Implementation

@generates

API

/**
 * Signs an OAuth 1.0 request using HMAC-SHA1
 *
 * @param {string} httpMethod - The HTTP method (GET, POST, etc.)
 * @param {string} baseUrl - The base URL of the request
 * @param {Object} params - OAuth and request parameters as key-value pairs
 * @param {string} consumerSecret - The OAuth consumer secret
 * @param {string} tokenSecret - The OAuth token secret (use empty string if not available)
 * @returns {string} Base64-encoded HMAC-SHA1 signature
 */
function signRequest(httpMethod, baseUrl, params, consumerSecret, tokenSecret) {
  // Implementation here
}

module.exports = { signRequest };

Dependencies { .dependencies }

oauth-sign { .dependency }

Provides OAuth 1.0 signature generation with HMAC-SHA1 support.

@satisfied-by