Generating an iOS OAuth signature?

It turns out that the signature creation part (HMAC-SHA1) is correct. I just needed to remove characters from the header before making the HTTP request, otherwise the OAUTH request would think that the signature would not match the request itself. Fixed code:

// this is a convenience function for oauth
- (NSData *)fetchDataForURL:(NSString *)url paramPairs:(NSArray *)paramPairs error:(NSError**)error response:(NSHTTPURLResponse**)response timeOut:(float)timeOut {

  NSMutableString *mutableURL = [[NSMutableString alloc] init];
  [mutableURL appendString:url];
  int paramPairCount = 0;
  for (OPTTradeKingParamPair *paramPair in paramPairs) {
    if (paramPairCount > 0)
      [mutableURL appendString:@"&"];
    [mutableURL appendFormat:@"%@=", paramPair.param];
    int argCount = 0;
    for (NSString *arg in paramPair.args) {
      if (argCount > 0)
        [mutableURL appendString:@","];
      [mutableURL appendFormat:@"%@", arg];
      argCount++;
    }
    paramPairCount++;
  }

  //NSLog(@"URL request: %@", mutableURL);
  NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:mutableURL] cachePolicy:NSURLRequestReloadIgnoringLocalCacheData timeoutInterval:5];
  request.HTTPMethod = @"GET";

  // oauth fields
  NSString *oauth_timestamp = [NSString stringWithFormat:@"%lu", (unsigned long)[NSDate.date timeIntervalSince1970]];
  NSString *oauth_nonce = [NSString getNonce];
  NSString *oauth_consumer_key = @"*****";
  NSString *oauth_token = @"*****";
  NSString *oauth_signature_method = @"HMAC-SHA1";
  NSString *oauth_version = @"1.0";

  NSMutableDictionary *standardParameters = [NSMutableDictionary dictionary];
  [standardParameters setValue:oauth_consumer_key     forKey:@"oauth_consumer_key"];
  [standardParameters setValue:oauth_nonce            forKey:@"oauth_nonce"];
  [standardParameters setValue:oauth_signature_method forKey:@"oauth_signature_method"];
  [standardParameters setValue:oauth_timestamp        forKey:@"oauth_timestamp"];
  [standardParameters setValue:oauth_version          forKey:@"oauth_version"];
  [standardParameters setValue:oauth_token            forKey:@"oauth_token"];

  NSMutableArray *paramPairKeys = [[NSMutableArray alloc] init];
  for (OPTTradeKingParamPair *paramPair in paramPairs) {
    NSString *key = paramPair.param;
    NSMutableString *args = [[NSMutableString alloc] init];

    int argCount = 0;
    for (NSString *arg in paramPair.args) {
      if (argCount > 0)
        [args appendString:@","];
      [args appendFormat:@"%@", arg];
    }

    [standardParameters setValue:args forKey:key];
    [paramPairKeys addObject:key];
  }

  NSString *parametersString = CHQueryStringFromParametersWithEncoding(standardParameters, NSUTF8StringEncoding);
  // use URL and remove ? (always at end of URL)
  NSString *request_url = [url stringByReplacingOccurrencesOfString:@"?" withString:@""];
  NSString *oauth_consumer_secret = @"*****";
  NSString *oauth_token_secret = @"*****";
  NSString *baseString = [@"GET" stringByAppendingFormat:@"&%@&%@", request_url.utf8AndURLEncode, parametersString.utf8AndURLEncode];
  // append oauth token secret to consumer secret
  NSString *secretString = [oauth_consumer_secret.utf8AndURLEncode stringByAppendingFormat:@"&%@", oauth_token_secret.utf8AndURLEncode];
  NSString *oauth_signature = [self.class signClearText:baseString withSecret:secretString];
  standardParameters[@"oauth_signature"] = oauth_signature;

  // remove symbols portion for header before doing request
  for (NSString* keyToRemove in paramPairKeys) {
    [standardParameters removeObjectForKey:keyToRemove];
  }
  [standardParameters removeObjectForKey:@"symbols"];

  NSMutableArray *parameterPairs = [NSMutableArray array];
  for (NSString *name in standardParameters)
  {
    NSString *aPair = [name stringByAppendingFormat:@"=\"%@\"", [standardParameters[name] utf8AndURLEncode]];
    [parameterPairs addObject:aPair];
  }
  parameterPairs = [NSMutableArray arrayWithArray:[parameterPairs sortedArrayUsingSelector:@selector(localizedCaseInsensitiveCompare:)]];

  NSString *oAuthHeader = [@"OAuth " stringByAppendingFormat:@"%@", [parameterPairs componentsJoinedByString:@", "]];
  [request setValue:oAuthHeader forHTTPHeaderField:@"Authorization"];

  NSData * data = [NSURLConnection sendSynchronousRequest:request returningResponse:response error:error];
  [OPTCrashModule addErrorWithData:data error:*error];
  return data;
}

      

        
        
        
      

    

How to call the code:

- (DataAPIReturnVal)findInfoForSymbols:(NSArray*)tickerSymbols returnedTickerInfos:(NSMutableArray *)tickerInfos
{
  NSMutableString *symbols = [[NSMutableString alloc] init];
  int index = 0;
  for(NSString *tickerSymbol in tickerSymbols)
  {
    if (index > 0) [symbols appendString:@","];
    OPTTickerInfo *tickerInfo = [[OPTTickerInfo alloc] init];
    [tickerInfo setName:tickerSymbol];
    [tickerInfos addObject:tickerInfo];
    [symbols appendString:[tickerSymbol uppercaseString]];
    index++;
  }

  NSMutableArray *paramPairs = [[NSMutableArray alloc] init];
  OPTTradeKingParamPair *paramPair = [[OPTTradeKingParamPair alloc] initWithParam:@"symbols" args:@[symbols]];
  [paramPairs addObject:paramPair];

  DataAPIReturnVal retVal = DataAPIGeneralError;
  NSHTTPURLResponse *response = nil;
  NSError *error = nil;
  NSData * retData = [self     fetchDataForURL:@"https://api.tradeking.com/v1/market/ext/quotes.json?" paramPairs:paramPairs error:&error response:&response timeOut:[tickerSymbols count]];
// ....and so on
}

      

        
        
        
      

    

Pair-pairs are simply an array of objects, where each object is a string "param" and "args". The parameter can be something like "characters" and "args" can be actual character arguments, i.e. fas, faz, msft, etc.

Additional material people have requested:

- (NSString *)signClearText:(NSString *)text withSecret:(NSString *)secret
{
  NSData *secretData = [secret dataUsingEncoding:NSUTF8StringEncoding];
  NSData *clearTextData = [text dataUsingEncoding:NSUTF8StringEncoding];
  unsigned char result[20];
  hmac_sha1((unsigned char *)[clearTextData bytes], [clearTextData length], (unsigned char *)[secretData bytes], [secretData length], result);

  //Base64 Encoding
  char base64Result[32];
  size_t theResultLength = 32;
  Base64EncodeData(result, 20, base64Result, &theResultLength);
  NSData *theData = [NSData dataWithBytes:base64Result length:theResultLength];

  return [NSString.alloc initWithData:theData encoding:NSUTF8StringEncoding];
}

      

        
        
        
      

    

I need to spend some time packaging the code for general use. There are tons of other things I have to push out before the general public can reuse it.