OAuthRequest - Twitter count param

[bdil24]

Hi,
I'm using scribejava to authenticate and hit endpoints for Twitter. A couple of the endpoints take a "count" parameter, such as "https://api.twitter.com/1.1/followers/list.json". If I add this parameter, I get an unauthorized response, but it works without. A google search came back that perhaps the parameters have to be in alphabetical order. Is there a way to do that with an OAuthRequest? To send the "count" param before the oauth parameters and other parameters. Here is a snippet doing the request:

OAuthRequest request = new OAuthRequest(Verb.GET, "https://api.twitter.com/1.1/followers/list.json");
request.addQuerystringParameter("screen_name", "user name");
service.signRequest(token, request);

Subsequent calls add on the "cursor" param to get the next page, but adding "count" there or before the screen name gives unauthorized or is ignored.
request.addQuerystringParameter("count", "100");

If this is beyond the scope of the library or better put on the twitter forum, I can try there.
Thanks!

[kullfar]

Hi, I think parameters order is important only for oauth_signature generating.
It generates here https://github.com/scribejava/scribejava/blob/master/scribejava-core/src/main/java/com/github/scribejava/core/oauth/OAuth10aService.java#L86

and actual code, that use all params are here
https://github.com/scribejava/scribejava/blob/master/scribejava-core/src/main/java/com/github/scribejava/core/extractors/BaseStringExtractorImpl.java#L21

As you can see

    protected String getSortedAndEncodedParams(OAuthRequest request) {
        final ParameterList params = new ParameterList();
        params.addAll(request.getQueryStringParams());
        params.addAll(request.getBodyParams());
        params.addAll(new ParameterList(request.getOauthParameters()));
        return params.sort().asOauthBaseString();
    }

it does sort all params before using in sign process. So, I don't think it's a problem.
But you can try playing with ScribeJava sources and try to find the solution.

[bdil24]

Thanks, I checked this class, and the order is correct. I'll look into from the twitter angle then.

[bdil24]

I didn't resolve this yet, but for SA, I did open a Twitter forum topic on this - https://twittercommunity.com/t/count-parameter-on-list-endpoint-returning-unauthorized/110170/3

[kullfar]

👍

[kullfar]

I have one idea. Maybe param 'count' should be excluded from request sign generation?
Btw, does the twitter reference/docs/specs have some additional information about this param.

[bdil24]

There is nothing special referenced about this param, but here is the API spec for one of the calls -https://developer.twitter.com/en/docs/accounts-and-users/follow-search-get-users/api-reference/get-friends-list . Where is the sign generation happening? I could try it out.

[kullfar]

I mentioned the method getSortedAndEncodedParams before.
You can try to exclude 'count' param right here and see what will happen

[bdil24]

Excluding it there excludes it from the request - is there a way to exclude it from the signature generation and not the request itself?

[kullfar]

no, it will not be excluded from the request. It will do exactly what you need - exclude from the signature generation. like this

   protected String getSortedAndEncodedParams(OAuthRequest request) {
        final ParameterList params = new ParameterList();
        params.addAll(request.getQueryStringParams());
        params.addAll(request.getBodyParams());
        params.addAll(new ParameterList(request.getOauthParameters()));

**params.remove('count');**

        return params.sort().asOauthBaseString();
    }

this collection 'params' here is used only to sort and generate oAuthBaseString

[bdil24]

Ok, that makes sense. I don't get an unauthorized status code back with this change, but it ignores the count parameter.

[kullfar]

'it ignores' you mean 'didn't send to twitter'?

[bdil24]

Sorry - I meant the count doesn't change (as if twitter ignores it), but I get back a valid response with the default 20 results from twitter with the count removed from the signature.

[kullfar]

Hi, do you have any news?

[kullfar]

outdated