One requirement of the OAuth spec is the "Lexicographical Byte Value Ordering" of request parameters. The term Lexicographical is misleading as it implies a form of case-insensitive dictionary sorting whereas in practice, the spec implements an Ordinal sort. Specifically and more simply put -all the spec requires is sorting by ASCII character value. In case two parameters share the same name, then the ordering convention applies to both the parameter's name and value -i.e., concatenate key+value before sorting and call it a day.

To keep things simple, I found that expanding the parameter key/value pairs into strings of ASCII codes represented in hexadecimal format allows a simple asort($myByteArray, SORT_STRING) PHP builtin function to do the trick.

Pass in a delimited string of key=value pairs and this function will return a string with the parameters urlencoded, sorted Ordinally by ASCII values as per the OAuth spec:




Params in:
Msg=Hello World!, MSg=Hello World!, 1=one ,za=1, a= 2>1, B= 2 , c= hi there,f=50, f=25 , f=a, test=z, test=z1, test=z12, test=

Outputs:

1=one&B=2&MSg=Hello World!&Msg=Hello World!&a=2>1&c=hi there&f=25&f=a&f=50&test=&test=z12&test=z&test=z1&za=1


(Actual output with urlencoding)

1=one&B=2&MSg=Hello%20World%21&Msg=Hello%20World%21&a=2%3E1&c=hi%20there&f=25&f=a&f=50&test=&test=z12&test=z&test=z1&za=1

2 comments:

Wayne said...

I've noticed a small problem in the case of duplicate parameter names. Notice the f=a in the sample above is in between f=25 and f=50. This is due to the way I concatenate key+value before ordering. I was trying to avoid dealing with it another way but I'll work at a different solution.

This will only be an issue in the unlikely case of parameter name duplication.

rogers setiady said...

hi, thanks for share, your code is helpful,
output is good, but i got this error :
Undefined index: value

at this line :
// Concatenate key+val pairs and expand to array of char bytes.
$chars = str_split($param['key'].$param['value'],1);

is it okay?
sorry my english not good.

Dynamic Page QR Code

Popular Posts

My LinkedIn PingTag


View My Stats