Riya.OAuth.Helper 1.0.2

Riya.OAuth.Helper

A lightweight, zero-dependency OAuth 1.0 helper library implementing RFC 5849.

Provides both client-side (sign outbound requests) and server-side (validate inbound signatures) OAuth 1.0 support with HMAC-SHA1.

Installation

dotnet add package Riya.OAuth.Helper

Or via the NuGet Package Manager:

Install-Package Riya.OAuth.Helper

Target Frameworks

Quick Start

1. Client-Side — Sign an Outbound Request

Use BuildAuthorizationHeader to generate a complete Authorization: OAuth ... header for calling an OAuth 1.0 protected API:

using OAuth.Helper;

// Basic signing (consumer credentials only)
var authHeader = OAuthHelper.BuildAuthorizationHeader(
    httpMethod: "POST",
    url: "https://api.example.com/token",
    consumerKey: "your-consumer-key",
    consumerSecret: "your-consumer-secret");

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.example.com/token")
{
    Content = JsonContent.Create(new { grant = "scopes" })
};
request.Headers.TryAddWithoutValidation("Authorization", authHeader);

var response = await httpClient.SendAsync(request);

With Token Secret

When you have a token secret (e.g. from a previous token exchange), include it in the signing key per RFC 5849 §3.4.2:

var authHeader = OAuthHelper.BuildAuthorizationHeader(
    httpMethod: "GET",
    url: "https://api.example.com/v1/hotels",
    consumerKey: "your-consumer-key",
    consumerSecret: "your-consumer-secret",
    tokenSecret: "your-token-secret");

URLs with Query Parameters

Query-string parameters are automatically included in the signature base string per RFC 5849 §3.4.1.3. Multi-value keys (e.g. ?id=1&id=2) are fully supported:

var authHeader = OAuthHelper.BuildAuthorizationHeader(
    "GET",
    "https://api.example.com/users?status=active&page=2",
    consumerKey,
    consumerSecret);

2. Server-Side — Validate an Incoming Signature

Use ParseAuthorizationHeader + VerifySignature to validate OAuth 1.0 signed requests:

using OAuth.Helper;

// 1. Parse the Authorization header
var oauthParams = OAuthHelper.ParseAuthorizationHeader(authorizationHeader);
if (oauthParams is null)
    return Unauthorized("Missing or invalid OAuth header");

// 2. Validate required OAuth parameters are present
if (!oauthParams.ContainsKey("oauth_consumer_key") ||
    !oauthParams.ContainsKey("oauth_signature") ||
    !oauthParams.ContainsKey("oauth_timestamp") ||
    !oauthParams.ContainsKey("oauth_nonce"))
    return Unauthorized("Missing required OAuth parameters");

// 3. Validate timestamp (optional — ±5 min window)
if (long.TryParse(oauthParams["oauth_timestamp"], out var timestamp))
{
    var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
    if (Math.Abs(now - timestamp) > 300)
        return Unauthorized("OAuth timestamp expired");
}

// 4. Extract the signature and verify
var signature = oauthParams["oauth_signature"];
var isValid = OAuthHelper.VerifySignature(
    httpMethod: "POST",
    baseUrl: "https://api.example.com/token",
    oauthParams: oauthParams,
    consumerSecret: "the-consumer-secret",
    providedSignature: signature);

// With token secret (if applicable)
// var isValid = OAuthHelper.VerifySignature(
//     "POST", baseUrl, oauthParams, consumerSecret, signature,
//     tokenSecret: "the-token-secret");

if (!isValid)
    return Unauthorized("Invalid OAuth signature");

3. Utility — Generate Secure Random Strings

using OAuth.Helper;

var nonce  = CryptoHelper.GenerateRandomString(32);   // OAuth nonce
var secret = CryptoHelper.GenerateRandomString(48);   // Client secret
var token  = CryptoHelper.GenerateRandomString(64);   // Refresh / bearer token

API Reference

OAuthHelper

CryptoHelper

Signing Key (RFC 5849 §3.4.2)

The HMAC-SHA1 signing key is constructed as:

percent_encode(consumer_secret) & percent_encode(token_secret)

• If no token secret is available, pass an empty string (default) — the signing key becomes consumer_secret&
• Both parts are always percent-encoded before concatenation

CI/CD — Publishing to NuGet

This repository includes a GitHub Actions workflow (.github/workflows/publish.yml) that automatically publishes on version tag push.

Setup (one-time)

1. Create a NuGet API key at nuget.org/account/apikeys

   • Scope: Push
   • Package: Riya.OAuth.Helper

2. Add the secret in your GitHub repository:

   • Go to Settings → Secrets and variables → Actions
   • Add a new secret: NUGET_API_KEY with your API key value

Publishing a Release

# Tag a version
git tag v1.0.0
git push origin v1.0.0

The workflow will:

1. Build the project for both net8.0 and net10.0
2. Pack with the version from the tag
3. Push to nuget.org

You can also trigger manually from the Actions tab in GitHub.

License

MIT