Incorrect OAuth 1.0a signature generation in C#

Question

After reviewing the OAuth 1.0 documentation for signing requests, I'm struggling getting my signature to match what Postman generates. I've checked things are capitalized / lowercased when necessary, parameters are sorted, encoding is done where appropriate, but I'm missing something.

        public string SignRequest(string method, string url, string tokenSecret, Dictionary<string, string> parameters)
        {
            //, string consumerKey, string token, string timestamp, string nonce, string consumerSecret, string tokenSecret, string identityStatement
            string baseString = method.ToUpper() + "&" + Uri.EscapeDataString(url) + "&";

            string paramString = "";
            var list = parameters.Keys.ToList<string>();
            list.Sort();
            
            foreach (string key in list)
            {
                paramString += key + "=" + Uri.EscapeDataString(parameters[key]) + "&";
            }
            paramString = paramString.Remove(paramString.Length - 1, 1);

            baseString += Uri.EscapeDataString(paramString);

            string signingKey = Uri.EscapeDataString(consumerSecret) + "&" + Uri.EscapeDataString(tokenSecret);

            var signatureEncoding = new ASCIIEncoding();
            var keyBytes = signatureEncoding.GetBytes(signingKey);
            var signatureBaseBytes = signatureEncoding.GetBytes(baseString);
            var hmacsha1 = new HMACSHA1(keyBytes);
            var hashBytes = hmacsha1.ComputeHash(signatureBaseBytes);
            var signatureString = Convert.ToBase64String(hashBytes);

            return signatureString;
        }

I've tried to simplify it down by all the parameters being "1", both secrets "1", the consumer key "1", and a dummy URL for both my implementation and Postman - still getting different signatures. An example of calling it with "1"s and a bogus URL:

            postKeys.Add("oauth_consumer_key", "1");
            postKeys.Add("oauth_token", "1");
            postKeys.Add("oauth_signature_method", "HMAC-SHA1");
            postKeys.Add("oauth_timestamp", "1");
            postKeys.Add("oauth_nonce", "1");
            postKeys.Add("oauth_version", "1");

            string signature = SignRequest("GET", "http://hi.com", "1", postKeys);

When I use the same method for the initial retrieval of a token (no token secret yet), my signatures do match a Postman request.

I just can't figure out what I'm missing in here. This seems to match other implementations in other languages, but I can't figure out what I have wrong.

Incorrect OAuth 1.0a signature generation in C#

0 Answers0