Skip to content

Commit dd1974e

Browse files
Removed old tip about wrong implementation of OAuth 1.0 fixed on rest api v3
1 parent aaeffb1 commit dd1974e

File tree

1 file changed

+0
-1
lines changed

1 file changed

+0
-1
lines changed

source/includes/v3/_introduction.md

-1
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,6 @@ If you are having trouble generating a correct signature, you'll want to review
145145
* The OAuth nonce can be any randomly generated 32 character (recommended) string that is unique to the consumer key. Read more suggestions on [generating a nonce](https://dev.twitter.com/discussions/12445) on the Twitter API forums.
146146
* The OAuth timestamp should be the unix timestamp at the time of the request. The API will deny any requests that include a timestamp that is outside of a 15 minute window to prevent replay attacks.
147147
* You must use the store URL provided by the index when forming the base string used for the signature, as this is what the server will use. (e.g. if the store URL includes a `www` sub-domain, you should use it for requests)
148-
* Some OAuth libraries add an ampersand to the provided secret key before generating the signature. WooCommerce does *not* adhere to the OAuth spec in this regard and the ampersand should be removed prior to generating the signature. An ampersand at the end of the string will result in an invalid signature.
149148
* You may test your generated signature using LinkedIn's [OAuth test console](http://developer.linkedinlabs.com/oauth-test/) -- leave the member token/secret blank.
150149
* Twitter has great instructions on [generating a signature](https://dev.twitter.com/docs/auth/creating-signature) with OAuth 1.0a, but remember tokens are not used with this implementation.
151150
* Note that the request body is *not* signed as per the OAuth spec, see [Google's OAuth 1.0 extension](https://oauth.googlecode.com/svn/spec/ext/body_hash/1.0/oauth-bodyhash.html) for details on why.

0 commit comments

Comments
 (0)