Getting Invalid Signature error for OAuthGetRequestToken - How to fix?

Trello
, , , ,
1

Hi,
Are there any recent changes in OAuthGetRequestToken? It was working fine for months, but suddenly I am getting (400 - Invalid Signature) this error.

Request Url:

https://trello.com/1/OAuthGetRequestToken?scope=r+e+a+d+%2C+w+r+i+t+e&oauth_callback=http%3A%2F%2Flocalhost%3A8000%2Faccounts%2Ftrello%2Flogin%2Fcallback%2F

Method: POST

Params:
(personal info masked and added line breaks for readability)

Authorization: OAuth 1.0
oauth_callback="http://localhost:8000/accounts/trello/login/callback/",
oauth_consumer_key="ed35XXXXXXXXXXXXXXXXXXXXXc12b",
oauth_nonce="a30vQMPpr4w",
oauth_signature="a3Qh3D4KvI43NwvZmgjc%2FkrTrr0%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1665735825",
oauth_version="1.0"

Request Headers:

{

'Date': 'Fri, 14 Oct 2022 08:32:06 GMT', 

'Content-Type': 'text/plain; charset=utf-8', 

'Content-Length': '17', 

'X-Dns-Prefetch-Control': 'off', 

'X-Frame-Options': 'DENY', 

'X-Download-Options': 'noopen', 

'X-Permitted-Cross-Domain-Policies': 'none', 

'Referrer-Policy': 'strict-origin-when-cross-origin', 

'Surrogate-Control': 'no-store', 

'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate', 

'Pragma': 'no-cache', 

'Expires': '0', 

'X-Trello-Version': '1.163591.0', 

'X-Trello-Environment': 'Production (Micros)', 

'Access-Control-Allow-Origin': '*', 

'Access-Control-Allow-Methods': 'GET, PUT, POST, DELETE', 

'Access-Control-Allow-Headers': 'Authorization, Accept, Content-Type', 

'Access-Control-Expose-Headers': 'x-rate-limit-api-key-interval-ms, x-rate-limit-api-key-max, x-rate-limit-api-key-remaining, x-rate-limit-api-token-interval-ms, x-rate-limit-api-token-max, x-rate-limit-api-token-remaining', 

'X-Envoy-Upstream-Service-Time': '219', 

'Server': 'globaledge-envoy', 

'Expect-Ct': 'report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/trello-edge", max-age=86400', 

'Strict-Transport-Security': 'max-age=63072000; preload', 

'X-Content-Type-Options': 'nosniff', 

'X-Xss-Protection': '1; mode=block', 

'Atl-Traceid': '8dd9c171c70391a3', 

'Report-To': '{

 "endpoints": [

 {"url": "https://dz8aopenkvv6s.cloudfront.net"}

 ], 

 "group": "endpoint-1", 

 "include_subdomains": true, "max_age": 600

 }', 

'Nel': '{

 "failure_fraction": 0.001, 

 "include_subdomains": true, 

 "max_age": 600, 

 "report_to": "endpoint-1"

 }'

}

Status Code: 400 Bad Request

Response Text: Invalid Signature

I am using django-allauth library for Authorizing with Trello, which was working fine. Recently, I am getting “400 - invalid signature”. I tested using postman, same result.

I’m thinking that I might be missing some kind of required parameter that Trello is included recently when they generate the signature for verification.

Is there any document that lays out exactly what parameters need to be returned for the authorization? or what the header is expected to look like/contain?

Thanks

2

Same problem here, using django-allauth. I tediously checked the inputs and generated signature against this tool (http://lti.tools/oauth/) and it agrees with the signature that allauth is generating.

cc @bentley

3

Would like an explanation as to what change but did find a here mentioned here. Cannot include scope, expiration and name in the URL query params of the https://trello.com/1/OAuthGetRequestToken call. I validated the fix by hacking it into the allauth lib but not yet sure about a workout without editing allauth source.

4

Thank you MattS.