How to handle '*' for status update

[gaapdevteam]

We are using Scribe OAuth library to make api call to Twitter. Everything works fine until recently we found out we are getting ‘Could not authenticate you’ error if status contains ‘*’

To better understand why it’s not working, I did some experiment and use two reserved characters as example: ‘*(’

1. if base string is url-encode(percent-encode("*(")) (in this case will be %252A%2528), signature verification will fail.
2. if base string is percent-encode("") + url-encode(percent-encode("(")) (in this case will be %2A%2528), signature verification will success and "(" will get posted to my twitter account
3. if base string is percent-encode("*(") (in this case will be %2A%28), signature verification will also fail.

It looks like expected base string should be single percent encoded “*” and double encoded any other reserved characters. Is that expected behavior? Thanks,

[andypiper]

I’ve certainly observed this before, but I’m not entirely certain of the detail. What you’re describing sounds accurate, but I’d have to play around with it myself to confirm.

[gaapdevteam]

Thanks, please let me know once you find out how Twitter handle ‘*’.

[andypiper]

It sounds like Scribe is a Java-specific library, correct? I’m fairly sure that is it not part of our stack. I’d suggest that if the behaviour you’ve experimented works, then you’re likely to be safe following that methodology - I’m not sure how soon I’d have bandwidth to dig deeper on this.

[gaapdevteam]

Will you be able to take a quick look how you generated base string for verify signature? Is that single encoded * and double encoded any other reserved characters? Thanks,