Invalid Signature in Services Oauth

Question

When using the Services API with a PUT request, it returns an error saying that the signature is invalid. When working with POST I was getting access denied because the bundle was specified but this seems to be completely different.

401 Unauthorized : Invalid signature 21
["Invalid signature"]

For testing purposes, "Cache pages for anonymous users" and "Cache blocks" are both unchecked. I cleared the cache once to make sure it wasn't that.

It appears to be that the server generated signature does not match, but I saw the answer below, and the two signatures are completely different, not just missing a plus sign. I was able to log the signatures that the server sees to the devel debug log.

Service request with OAuth (Invalid signature error)

One thing I noticed which I wasn't sure about is that the base string that got logged for the request on the server started with GET, but this is a PUT request. Is that normal or could that be a bug in the implementation? My Oauth client is using PUT as the method.

---

Update: In looking into it, that does indeed seem to be the problem or at least part of it.

if($_SERVER['REQUEST_URI'] == '/api/rest/resource/18.json'){
    die('hi put' . $_SERVER['REQUEST_METHOD']);
}

The above code inserted at the beginning of index.php gives me hi putGET. However POST works perfectly fine.

My access log has this line

"PUT /api/rest/resource/21.json HTTP/1.1" 401 21 "empty referrer" "My User Agent String"

Answer 1

Once I figured out that the access log was different than the $_SERVER variable, I called my hosting provider and discovered that their servers are only configured to allow GET and POST (haven't checked HEAD).

So I invented this hack to use the header, since it seems that Apache just transparently changes unrecognized methods to GET.

if( isset($_SERVER['HTTP_X_REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST' ) {
    $_SERVER['REQUEST_METHOD'] = $_SERVER['HTTP_X_REQUEST_METHOD'];
}