# Http post and authorization header for twitter

**URL:** <https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207>\
**Category:** Ruby\
**Created:** [March 7, 2011, 8:53pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207 "2011-03-07T20:53:33Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [March 7, 2011, 8:53pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/1 "2011-03-07T20:53:33Z")

</div>

I am trying to send an authorization header to the twitter api  
([https://api.twitter.com/oauth/request\_token](https://api.twitter.com/oauth/request_token)). What is a good way to  
make a post request with a header in this case?

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 4:51am UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/2 "2011-03-08T04:51:45Z")

</div>

See if you can get something like this to work:

require ‘net/http’  
require ‘net/https’

http = Net::HTTP.new(‘profil.wp.pl’, 443) #(host, port)  
http.use\_ssl = true  
path = ‘/login.html’

# POST request → logging in

data =  
‘serwis=wp.pl&url=profil.html&tryLogin=1&countTest=1&logowaniessl=1&login\_username=blah&login\_password=blah’

headers = {  
‘Cookie’ =\> cookie,  
‘Referer’ =\> ‘[Poczta - Najlepsza Poczta, największe załączniki - WP](http://profil.wp.pl/login.html)’,  
‘Content-Type’ =\> ‘application/x-www-form-urlencoded’  
}

resp = http.post(path, data, headers)

[http://snippets.dzone.com/posts/show/788](http://snippets.dzone.com/posts/show/788)

If you leave out the port, it will default to 80. Read about the post()  
method here:

> **[Index of Classes & Methods in net/http: Ruby Standard Library Documentation...](http://www.ruby-doc.org/stdlib/libdoc/net/http/rdoc/index.html)**

Then read this to determine if net/https is secure enough for you:

> **[How to Cure Net::HTTP’s Risky Default HTTPS Behavior](https://rubyinside.com/how-to-cure-nethttps-risky-default-https-behavior-4010.html)**
>
> James Golick, a prolific Canadian Rubyist, has declared war on Net:HTTP's default of not checking the validity of the certificate sent by an HTTP server when making HTTPS requests. His new always\_verify\_ssl\_certificates gem forces Net::HTTP to verify...

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 7:24pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/3 "2011-03-08T19:24:26Z")

</div>

Thanks for the reply! So i tried that code and got this error: “Failed  
to validate oauth signature and token”. Here is my code:

url = URI.parse(“[https://api.twitter.com/oauth/request\_token](https://api.twitter.com/oauth/request_token)”)  
http = Net::HTTP.new(url.host, url.port)  
http.use\_ssl = true

resp = http.post(url.path, nil, @headers)

Any ideas??

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 7:26pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/4 "2011-03-08T19:26:08Z")

</div>

here are my headers. am i doing this correctly?

@headers = { ‘oauth\_nonce’ =\> @current\_nonce,  
‘oauth\_callback’ =\> @encoded\_callback,  
‘oauth\_signature\_method’ =\> “HMAC-SHA1”,  
‘oauth\_timestamp’ =\> @current\_timestamp,  
‘oauth\_consumer\_key’ =\> @oauth\_consumer\_key,  
‘oauth\_signature’ =\> @encoded\_oauth\_sig,  
‘oauth\_version’ =\> “1.0”}

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 7:57pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/5 "2011-03-08T19:57:39Z")

</div>

boo boo wrote in post #986241:

> Thanks for the reply! So i tried that code and got this error: “Failed  
> to validate oauth signature and token”. Here is my code:
> 
> url = URI.parse(“[https://api.twitter.com/oauth/request\_token](https://api.twitter.com/oauth/request_token)”)  
> http = Net::HTTP.new(url.host, url.port)  
> http.use\_ssl = true
> 
> resp = http.post(url.path, nil, @headers)
> 
> Any ideas??

No requires?

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 8:41pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/6 "2011-03-08T20:41:44Z")

</div>

…and what requires did the code I posted use? Now point to each one  
in your code.

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 8:36pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/7 "2011-03-08T20:36:24Z")

</div>

7stud – wrote in post #986255:

> boo boo wrote in post #986241:
> 
> > Thanks for the reply! So i tried that code and got this error: “Failed  
> > to validate oauth signature and token”. Here is my code:
> > 
> > url = URI.parse(“[https://api.twitter.com/oauth/request\_token](https://api.twitter.com/oauth/request_token)”)  
> > http = Net::HTTP.new(url.host, url.port)  
> > http.use\_ssl = true
> > 
> > resp = http.post(url.path, nil, @headers)
> > 
> > Any ideas??
> 
> No requires?

Sorry here is full source in my class:

require “oauth”

require “oauth/client”

require “cgi”

require “addressable/uri”

require ‘base64’  
require ‘cgi’  
require ‘openssl’

require “net/http”  
require "uri

class ProxyController

def initialize

```
@request_token_url = "https://api.twitter.com/oauth/request_token"
@authorize_url = "https://api.twitter/oauth/authorize_token"
@oauth_consumer_key = "MY KEY"
@oauth_consumer_secret = "MY SECRET"

@params = Addressable::URI.new

@current_nonce = self.nonce
@current_timestamp = self.timestamp.to_s

@params.query_values = {"oauth_callback"=> "my callback url",
                        "oauth_consumer_key" => @oauth_consumer_key,
                        "oauth_nonce" => @current_nonce ,
                        "oauth_signature_method" => "HMAC-SHA1",
                        "oauth_timestamp" => @current_timestamp,
                        "oauth_version" => "1.0"}

@params_string = @params.to_s
@params_string[0] = ""

@encoded_params = CGI::escape(@params_string)

@concatenated_body = "POST&" + CGI::escape(@request_token_url) + "&" 

```

- @encoded\_params

end

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 8:47pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/8 "2011-03-08T20:47:55Z")

</div>

7stud – wrote in post #986264:

> …and what requires did the code I posted use? Now point to each one  
> in your code.

I had required net/http but just added net/https as well and I still get  
same error

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 8:45pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/9 "2011-03-08T20:45:42Z")

</div>

boo boo wrote in post #986243:

> here are my headers. am i doing this correctly?
> 
> @headers = { ‘oauth\_nonce’ =\> @current\_nonce,  
> ‘oauth\_callback’ =\> @encoded\_callback,  
> ‘oauth\_signature\_method’ =\> “HMAC-SHA1”,  
> ‘oauth\_timestamp’ =\> @current\_timestamp,  
> ‘oauth\_consumer\_key’ =\> @oauth\_consumer\_key,  
> ‘oauth\_signature’ =\> @encoded\_oauth\_sig,  
> ‘oauth\_version’ =\> “1.0”}

Those don’t look like http headers. Http headers look like  
“Content-Type”, “Cookie”, etc. In addition, headers are strings–in  
fact everything you send in a request is a string, so I don’t know what  
those arrays are.

You said you need to POST the request. Is that data you are supposed to  
send in the body of the request? Once again, it has to be a string, not  
a ruby array.

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 8:50pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/10 "2011-03-08T20:50:19Z")

</div>

7stud – wrote in post #986265:

> boo boo wrote in post #986243:
> 
> > here are my headers. am i doing this correctly?
> > 
> > @headers = { ‘oauth\_nonce’ =\> @current\_nonce,  
> > ‘oauth\_callback’ =\> @encoded\_callback,  
> > ‘oauth\_signature\_method’ =\> “HMAC-SHA1”,  
> > ‘oauth\_timestamp’ =\> @current\_timestamp,  
> > ‘oauth\_consumer\_key’ =\> @oauth\_consumer\_key,  
> > ‘oauth\_signature’ =\> @encoded\_oauth\_sig,  
> > ‘oauth\_version’ =\> “1.0”}
> 
> Those don’t look like http headers. Http headers look like  
> “Content-Type”, “Cookie”, etc. In addition, headers are strings–in  
> fact everything you send in a request is a string, so I don’t know what  
> those arrays are.
> 
> You said you need to POST the request. Is that data you are supposed to  
> send in the body of the request? Once again, it has to be a string, not  
> a ruby array.

On the twitter doc it says:

Now that we have our signature, we have everything we need to make the  
request to the endpoint [https://api.twitter.com/oauth/request\_token](https://api.twitter.com/oauth/request_token). Now  
we just generate an HTTP header called “Authorization” with the relevant  
OAuth parameters for the request:

OAuth oauth\_nonce=“QP70eNmVz8jvdPevU3oJD2AfF7R7odC2XJcn4XlZJqk”,  
oauth\_callback=“http%3A%2F%2Flocalhost%3A3005%2Fthe\_dance%2Fprocess\_callback%3Fservice\_provider\_id%3D11”,  
oauth\_signature\_method=“HMAC-SHA1”, oauth\_timestamp=“1272323042”,  
oauth\_consumer\_key=“GDdmIQH6jhtmLUypg82g”,  
oauth\_signature=“8wUi7m5HFQy76nowoCThusfgB%2BQ%3D”, oauth\_version=“1.0”

Ok ill try passing as string…

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 8:53pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/11 "2011-03-08T20:53:22Z")

</div>

The http header name is “Authorization”, so you have to write something  
like:

headers = {‘Authorization’ =\> ???}

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 9:18pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/12 "2011-03-08T21:18:02Z")

</div>

7stud – wrote in post #986269:

> The http header name is “Authorization”, so you have to write something  
> like:
> 
> headers = {‘Authorization’ =\> ???}

Should it be like this (I made the value one giant string)?

I still get the failed to validate error

@headers = {“Authorization” =\> “oauth\_nonce = #{@current\_nonce},  
oauth\_callback = #{@encoded\_callback}, oauth\_signature\_method =  
HMAC-SHA1, oauth\_timestamp = #{@current\_timestamp}, oauth\_consumer\_key =  
#{@oauth\_consumer\_key}, oauth\_signature = #{@encoded\_oauth\_sig},  
oauth\_version = 1.0”}

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 9:41pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/13 "2011-03-08T21:41:31Z")

</div>

Thanks Mike,

This worked great.

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 9:21pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/14 "2011-03-08T21:21:42Z")

</div>

On Tue, Mar 8, 2011 at 12:53 PM, 7stud – [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> The http header name is “Authorization”, so you have to write something  
> like:
> 
> headers = {‘Authorization’ =\> ???}

FWIW, the headers are the third parameter to Net::HTTP#post and should  
be a hash like 7stud shows.

[http://ruby-doc.org/stdlib/libdoc/net/http/rdoc/classes/Net/HTTP.html#M001391](http://ruby-doc.org/stdlib/libdoc/net/http/rdoc/classes/Net/HTTP.html#M001391)

boo boo, you seem to be having a difficult time generating a proper  
OAuth request, which is why you are getting that error. You are  
already requiring the oauth library, I’m curious why you don’t just  
use that to calculate the signature and set the Authorization header  
for you?

# WARNING: Untested code follows

@consumer\_key = ‘MY KEY’  
@consumer\_secret = ‘MY SECRET’  
@callback = ‘SITE or oob’

consumer = OAuth::Consumer.new(  
@consumer\_key, @consumer\_secret,  
:site =\> ‘[https://api.twitter.com](https://api.twitter.com)’,  
:request\_token\_path =\> ‘/oauth/request\_token’,  
:authorize\_path =\> ‘/oauth/authorize’,  
:access\_token\_path =\> ‘/oauth/access\_token’,  
:http\_method =\> :post)

request\_token = consumer.get\_request\_token(  
:oauth\_callback =\> @callback)

#request token is request\_token.params[:oauth\_token]  
#request token secret is request\_token.params[:oauth\_token\_secret]

puts request\_token.authorize\_url

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 9, 2011, 8:31pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/15 "2011-03-09T20:31:33Z")

</div>

ok thanks for your advice i will have to try this

---

<div class="post-metadata">

**Author:** ![rubicunditional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/d2c977/32.png) [@rubicunditional](https://www.ruby-forum.com/u/rubicunditional)\
**Post date:** [March 8, 2011, 11:28pm UTC](https://www.ruby-forum.com/t/http-post-and-authorization-header-for-twitter/204207/16 "2011-03-08T23:28:09Z")

</div>

Thanks for the save Mike.

boo boo,

The value for the Authorization header _is_ one giant string-- you just  
have  
to get the syntax correct. Here is an example of the syntax required  
for the Authorization header (see the Authorization Header section):

> **[OAuth Core 1.0](https://oauth.net/core/1.0/)**
>
> OAuth Core 1.0

In fact, if you just put quotes around the whole string you got from the  
twitter docs, that would be the string you need. The trick is figuring  
out to create a string in ruby that has internal double quotes (hint:  
try a  
HEREDOC).

As an exercise, you might want to see if you can get it to work by hand.