iwhd security

Pete Zaitcev zaitcev at redhat.com
Wed Sep 21 16:46:08 UTC 2011


On Wed, 21 Sep 2011 17:21:04 +0100
Mark McLoughlin <markmc at redhat.com> wrote:

> i.e. you just pass the credentials that the RFC describes passed in the
> request token phase of three-legged OAuth. You don't ever actually
> obtain a token.

> Right, iwhd would be a server and would authenticate the
> oauth_consumer_key and oauth_signature parameters in the Authorization
> header against a key and secret in its config file.

I see, thanks.

> Have you looked at liboauth? It looks like tests/oauthtest2.c does the
> client side of two-legged oauth, but you should be able to use the
> similar code to generate a signature and check against the supplied one?

Going to do it today, thanks for the tip.

-- Pete


More information about the iwhd-devel mailing list