URL自动填充参数导致的OAuth签名验证失败

很简单的OAuth服务器实现：

function startup(&$controller) {
try {
$req = OAuthRequest::from_request();
if (empty($_GET['oauth_token'])) {
//strip down to 2 legged
$consumer = self::$oauth_server->get_consumer($req);
self::$oauth_server->check_signature( $req, $consumer, NULL );
$controller->data['oauth_consumer'] = $consumer;
} else {
//3 legged
list($consumer, $token) = self::$oauth_server->verify_request($req);
if(!empty($consumer) /*&& $req->get_normalized_http_method() == 'GET'*/) {
$controller->data['oauth_token'] = $token;
$controller->data['oauth_consumer'] = $consumer;
}
}

catch(OAuthException $e) {

....

}

对于2legged的情况总是签名验证失败。原因出在from_request()的调用上，该函数在原来的客户端请求url上添加了一个url参数。

导致重新构造的签名和通过url传递的不相符合。

解决方法是重置掉该自动添加的参数

if($req->get_parameter('url')) {
$req->unset_parameter('url');//unset auto-appended params
}

regards,

iefreer