Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
OAuth for Common Lisp
Fetching latest commit…
Cannot retrieve the latest commit at this time.
|Type||Name||Latest commit message||Commit time|
|Failed to load latest commit information.|
This is cl-oauth, an implementation of the OAuth 1.0a standard in Common Lisp. Spec URI: http://oauth.net/core/1.0a Section numbers mentioned in the code and documentation refer to this document, unless mentioned otherwise. Most of the code has passed basic manual and automated tests, but the SP code hasn't been used in a real-world application yet. Not supported at this time: Service Provider: * parameters from Auth header (needs some parsing) [5.4] in principle a MUST, but as SP you get to decide ;) * Nonce checking , a SHOULD. * Session extension http://oauth.googlecode.com/svn/spec/ext/session/1.0/drafts/1/spec.html * Problem Reporting extension http://oauth.pbworks.com/ProblemReporting Consumer: * Auth parameters should be working, but Google rejects them for some reason. Do more testing and debugging. * Revoking tokens as per section 7 of the Session extension * Problem Reporting extension: fields in body are ignored. Both: * crypto signatures different from HMAC-SHA1. It's easy to use other digests and MACs via Ironclad but RSA needs to have padding implemented. [9.3] * PLAINTEXT signature. Meh. [9.4] * POST and Auth requests are hardly tested yet. People who contributed in a substantial way to this library: * Leslie P. Polzer <email@example.com>: base implementation. See also revision log for minor contributions. TODO (apart from spec things not implemented yet): * grep the code for TODO and FIXME * incorporate test cases from http://wiki.oauth.net/TestCases * abstract token storage, can't get far with volatile memory FETCH-TOKEN/STORE-TOKEN * better handling of different protocol versions; in particular we should support serving both 1.0 and 1.0a clients (and requesting stuff from 1.0 and 1.0a servers too, of course). * compare with the Hammer draft spec and resolve differences * always store the URL-decoded key/secret in the request token