1

There is already a StackOverflow post that has addressed this issue. However, it couldn't help me.

So, I have written an OpenID login implementation using DotNetOpenAuth and I keep on getting "Message signature was incorrect".

The funny thing is that this is happening from a PC I have at my home. At my work I'm not getting this error and it is working ok.

I've tried to add in the web.config

<trust level="Full" />
<httpRuntime maxQueryStringLength="20000" />

Also, I've added the null parameter while instantiating the OpenIdRelyingParty

new OpenIdRelyingParty(null)

Lastly, I've opened the 443 port in the router and PC.

The key factor is that this is not working from the PC I have at home. However, it is working from the PC I have at work. Both have the same exact code.

Community
  • 1
  • 1
billaraw
  • 938
  • 1
  • 7
  • 28
  • Are you testing it with the same data at home as you are at work? – Brian Dishaw May 23 '11 at 01:51
  • Yes, with the same account. Can there be a port that is blocking this maybe? I can't think of anything else. – billaraw May 23 '11 at 18:56
  • Sorry to reopen this topic, but have you already got a solution? I have the same problem: I use Google and Yahoo. Both work fine on the development server of Visual Studio, but on the live server only Yahoo works. – Marthijn Feb 09 '12 at 08:44

2 Answers2

3

When you make a request to an OAuth provider, the framework generates a signature. This signature is a hash of different values, including the URL that you are requesting. The provider then does the same and performs a comparison. If the hash that the provider builds is not the same as the one you've provided via the oauth_signature query string parameter, the request is not considered valid, and you get this error.

I ran into a similar issue when my client application was signing an URL that was something along the lines of api.foo.com/oauth. The server had an URL rewriter that rewrote the URL to foo.com/api/oauth before the provider had a chance to process anything. Since the client URL and the URL that was processed by the provider were different, this caused different signatures, hence the error.

csano
  • 13,266
  • 2
  • 28
  • 45
1

Check your computer clock. The time should be correct as well as the timezone.

If that doesn't help it, please activate logging and see if it gives you more details about why the signature is wrong.

David Christiansen
  • 5,869
  • 2
  • 36
  • 42
Andrew Arnott
  • 80,040
  • 26
  • 132
  • 171