如何使用 Clojure 和 clj-oauth 对 POST 请求进行签名？答案

【问题标题】：How do I sign a POST request with a body using Clojure and clj-oauth?如何使用 Clojure 和 clj-oauth 对 POST 请求进行签名？
【发布时间】：2016-08-10 20:14:06
【问题描述】：

我正在尝试与使用 OAuth 1 的 quickbooks 在线 REST API 进行通信：

我可以像这样构造任意 GET 请求：

(require '[oauth.client :as oauth])
(require '[cheshire.core :refer :all])
(require '[clj-http.client :as client])

(def OAuth-Consumer-Key     "qyprdtoUhI8AjLxEQ9tucTJkSiklKn")
(def OAuth-Consumer-Secret  "*********************")

(def OAuth-Access-Token         "qyprdaXOWBph7MUnkqzRVruovEMlvgUH52Gup8kfinSgbnJL")
(def OAuth-Access-Token-Secret  "********************************" )


(def consumer (oauth/make-consumer OAuth-Consumer-Key
                                   OAuth-Consumer-Secret
                                   ""
                                   ""
                                   ""
                                   :hmac-sha1))


(def get-url "https://sandbox-quickbooks.api.intuit.com/v3/company/123145835981692/account/4")

(def get-user-params {})

(def get-credentials (oauth/credentials consumer
                                    OAuth-Access-Token
                                    OAuth-Access-Token-Secret
                                    :GET
                                    get-url
                                    get-user-params))

(client/get get-url {:query-params (merge get-credentials get-user-params) })

但我无法构造 POST 请求。如果我将正文放在用户参数中，那么似乎身份验证有效，但 API 拒绝接受请求，但如果我不接受，它首先不会进行身份验证。

(def post-body "<Customer xmlns=\"http://schema.intuit.com/finance/v3\" domain=\"QBO\" sparse=\"false\">\n<CompanyName>Best Company</CompanyName>\n<DisplayName>Sir Jonhn Doe</DisplayName>\n<BillAddr>\n<Line1>123 Main Street</Line1>\n<City>Mountain View</City>\n<Country>USA</Country>\n<CountrySubDivisionCode>CA</CountrySubDivisionCode>\n<PostalCode>94042</PostalCode>\n</BillAddr>\n</Customer>")

(def post-user-params {:content-type "application/xml" :body post-body})

(def post-credentials (oauth/credentials consumer
                     OAuth-Access-Token
                     OAuth-Access-Token-Secret 
                     :POST
                     "https://sandbox-quickbooks.api.intuit.com/v3/company/123145835981692/customer"
                     post-user-params))


(client/post "https://sandbox-quickbooks.api.intuit.com/v3/company/123145835981692/customer"
             {:query-params (merge post-user-params post-credentials)
              :body post-body})

这个手工制作的版本虽然很好用。（使用 Chrome 的 Postman 扩展完成）。

(client/post "https://sandbox-quickbooks.api.intuit.com/v3/company/123145835981692/customer"
                   {:headers {:authorization "OAuth oauth_consumer_key=\"qyprdtoUhI8AjLxEQ9tucTJkSiklKn\",oauth_token=\"qyprdaXOWBph7MUnkqzRVruovEMlvgUH52Gup8kfinSgbnJL\",oauth_signature_method=\"HMAC-SHA1\",oauth_timestamp=\"1470828646\",oauth_nonce=\"WXZu67\",oauth_version=\"1.0\",oauth_signature=\"a66RFI8clxNIhv8M1YzzijDgE1A%3D\""
                              :content-type "application/xml",
                              :cache-control "no-cache",
                              :postman-token "0effd852-8271-7f66-f43d-6710443c5107"}
                    :body post-body})

谁能看到我应该怎么做才能正确签署请求？

【问题讨论】：

标签： oauth clojure quickbooks-online

【解决方案1】：

最终我发现这个咒语有效。看来您实际上不需要在正文上签名。关键的变化是将 content-type 移到 post 请求中并移出有符号位。

我不知道这里发生了什么！

(def post-url "https://sandbox-quickbooks.api.intuit.com/v3/company/123145835981692/customer")

(def post-body (str "<Customer xmlns=\"http://schema.intuit.com/finance/v3\" domain=\"QBO\" sparse=\"false\">\n"
                    "<CompanyName>Company</CompanyName>\n"
                    "<DisplayName>Sir Jeaweaaan Doe</DisplayName>\n"
                    "<BillAddr>\n"
                    "<Line1>123 Main Street</Line1>\n"
                    "<City>Mountain View</City>\n"
                    "<Country>USA</Country>\n"
                    "<CountrySubDivisionCode>CA</CountrySubDivisionCode>\n"
                    "<PostalCode>94042</PostalCode>\n"
                    "</BillAddr>\n"
                    "</Customer>"))

(def post-user-params {
                       :cache-control "no-cache"
                       })

(def post-credentials (oauth/credentials consumer
                     OAuth-Access-Token
                     OAuth-Access-Token-Secret 
                     :POST
                     post-url
                     post-user-params))


(que? (client/post post-url
                   {:query-params (merge post-user-params post-credentials)
                    :content-type "application/xml"
                    :body post-body
              }))

【讨论】：