title: "What" does oauth_signature sign?
body: <p>In the section <a href="http://oauth.net/core/1.0/#auth_step1" rel="nofollow noreferrer">6.1.1. Consumer Obtains a Request Token</a> of the OAuth Spec says that you  must send a request that contains the following paramter:</p>
  <pre><code>oauth_signature:
      The signature as defined in Signing Requests.
  </code></pre>
  <p>But how can you sign the request if the <code>oauth_signature</code> itself is part of it? I mean, &quot;what&quot; do you sign? All the fields except the <code>oauth_signature</code> or what?</p>
  <p>For example, in the <a href="https://www.rfc-editor.org/rfc/rfc5849" rel="nofollow noreferrer">The OAuth 1.0 Protocol</a> they provide the following example of obtaining the temporary credentials:</p>
  <pre><code>POST /initiate HTTP/1.1
  Host: photos.example.net
  Authorization: OAuth realm=&quot;Photos&quot;,
      oauth_consumer_key=&quot;dpf43f3p2l4k3l03&quot;,
      oauth_signature_method=&quot;HMAC-SHA1&quot;,
      oauth_timestamp=&quot;137131200&quot;,
      oauth_nonce=&quot;wIjqoS&quot;,
      oauth_callback=&quot;http%3A%2F%2Fprinter.example.com%2Fready&quot;,
      oauth_signature=&quot;74KNZJeDHnMBp0EMJ9ZHt%2FXKycU%3D&quot;
  </code></pre>
  <p>But how did they get the <code>oauth_signature</code> field? <strong>What</strong> was it that they <em>signed</em>?</p>
  <p>Sorry, new to crypto - so dummy explanation would be appreciated.</p>