title: OAuth authentication, invalid signature
body: <p>I tired to port the <a href="https://github.com/maraujop/requests-oauth" rel="nofollow">request-oauth</a> library (based on <a href="https://github.com/kennethreitz/requests" rel="nofollow">python-request</a>) to Python 3 (with help of 2to3) but I have problems to validate a signature with StatusNet (same API as Twitter).</p>
  
  <p>When I do a request to <code>oauth/request_token</code>, I have no problem but to <code>oauth/access_token</code> I have an error <code>401 Invalid signature</code>. I don't understand why because it seems to me that what I sign is correct.</p>
  
  <p>For example, with the python 2 code, cf <a href="http://paste.pocoo.org/show/568734/" rel="nofollow">hook.py</a> and <a href="http://paste.pocoo.org/show/568735/" rel="nofollow">auth.py</a> (original from the git repo), I get :</p>
  
  <pre><code>signing_key = '0de1456373dfc9349dd38a48e61fc844&amp;136d6b9a597ee57d4338254812681acd',
  signing_raw = 'POST&amp;http%3A%2F%2Fstatus2.dotzero.me%2Fapi%2Foauth%2Faccess_token&amp;oauth_consumer_key%3Dec3ad931b294b51a5ff595c732acb7a5%26oauth_nonce%3D33448267%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1332279747%26oauth_token%3D2131043f3516bcb730d391ed2033a880%26oauth_verifier%3D8816492%26oauth_version%3D1.0'
  oauth_hook.token.key = '2131043f3516bcb730d391ed2033a880'
  oauth_hook.token.secret = '136d6b9a597ee57d4338254812681acd'
  request.data_and_params = {'oauth_version': '1.0', 'oauth_signature': 'xyjxH5QcfZXnG111L7qANZ+ahRI=',
      'oauth_token': '2131043f3516bcb730d391ed2033a880', 'oauth_nonce': '33448267', 
      'oauth_timestamp': '1332279747', 'oauth_verifier': '8816492', 
      'oauth_consumer_key': 'ec3ad931b294b51a5ff595c732acb7a5', 
      'oauth_signature_method': 'HMAC-SHA1'}
  </code></pre>
  
  <p>and with my python 3 port, cf <a href="http://paste.pocoo.org/show/568745/" rel="nofollow">hook.py</a> and <a href="http://paste.pocoo.org/show/568743/" rel="nofollow">auth.py</a>, I get :</p>
  
  <pre><code>signing_key = '0de1456373dfc9349dd38a48e61fc844&amp;136d6b9a597ee57d4338254812681acd',
  signing_raw = 'POST&amp;http%3A%2F%2Fstatus2.dotzero.me%2Fapi%2Foauth%2Faccess_token&amp;oauth_consumer_key%3Dec3ad931b294b51a5ff595c732acb7a5%26oauth_nonce%3D52360702%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1332278837%26oauth_token%3D2131043f3516bcb730d391ed2033a880%26oauth_verifier%3D8816492%26oauth_verifier%3D8816492%26oauth_version%3D1.0'
  oauth_hook.token.key = '2131043f3516bcb730d391ed2033a880'
  oauth_hook.token.secret = '136d6b9a597ee57d4338254812681acd'
  request.data_and_params = {'oauth_nonce': '52360702', 'oauth_timestamp': '1332278837', 
      'oauth_verifier': '8816492', 'oauth_consumer_key': 'ec3ad931b294b51a5ff595c732acb7a5', 
      'oauth_signature_method': 'HMAC-SHA1', 'oauth_version': '1.0', 
      'oauth_token': '2131043f3516bcb730d391ed2033a880',
      'oauth_signature': 'BRsb11dk++405uaq5pRS+CMUzbo='}
  </code></pre>
  
  <p>Both looks good to me but the first one succeed and the second returns a 401 error, invalid signature.</p>
  
  <p>In both cases, I get the <code>token.key</code> and <code>token.secret</code> as the result of :</p>
  
  <pre><code>OAuthHook.consumer_key = self.ckey
  OAuthHook.consumer_secret = self.csecret
  oauth_hook = OAuthHook()
  client = requests.session(hooks={'pre_request': oauth_hook})
  response = client.post('%soauth/request_token' % (self.url), {'oauth_callback': 'oob'})
  # new oauth_hook with the request token
  oauth_hook = OAuthHook(response[b'oauth_token'][0],response[b'oauth_token_secret'][0])
  </code></pre>
  
  <p>Them, I go to <code>oauth/authorize?oauth_token=%s" % oauth_hook.token.key</code> to get authorize the app and get a pincode. After that I can do the problematic request</p>
  
  <pre><code>...
  response = client.post('%soauth/request_token' % (self.url), {'oauth_callback': 'oob'})
  oauth_hook = OAuthHook(response[b'oauth_token'][0],response[b'oauth_token_secret'][0])
  # get the pincode from %soauth/authorize?oauth_token=%s" % (self.url, oauth_hook.token.key)
  oauth_hook.token.set_verifier(pincode)
  client = requests.session(hooks={'pre_request': oauth_hook})
  response = client.post("%soauth/access_token" % (self.url),
                   {'oauth_verifier': pincode})
  </code></pre>
  
  <p>The signature code from the auth.py file is</p>
  
  <pre><code>def sign(self, request, consumer, token):
      """Builds the base signature string."""
      key, raw = self.signing_base(request, consumer, token)
      hashed = hmac.new(key.encode(), raw.encode(), sha1)
      # Calculate the digest base 64.
      return binascii.b2a_base64(hashed.digest())[:-1]
  </code></pre>
  
  <p>Any idea why it doesn't work with the py3k code ?</p>
  
  <p>Thank you</p>