title: What is the right way to sign POST requests with OAuth-Signpost and Apache HttpComponents?
body: <p>I'm currently using the OAuth-Signpost Java library to sign requests sent from a client to a server which implements OAuth authentication. When making GET requests (using HttpURLConnection) everything works fine: requests are signed, parameters are included and signatures match in destination. However, it doesn't seem to work with POST requests. I'm aware of the issues that may come up when signing POST using HttpURLConnection, so I moved to the Apache HttpComponents library for these requests. The parameters I send in the following example are plain strings and a XML-like string ('rxml'). My code goes as follows:</p>
  
  <pre><code>public Response exampleMethod(String user, String sp, String ep, String rn, String rxml){
  
     //All these variables are proved to be correct (they work right in GET requests)
      String uri = "...";
      String consumerKey = "...";
      String consumerSecret = "...";
      String token = "...";
      String secret = "...";
  
    //create the parameters list
      List&lt;NameValuePair&gt; params = new ArrayList&lt;NameValuePair&gt;();
      params.add(new BasicNameValuePair("user", user));
      params.add(new BasicNameValuePair("sp", sp));
      params.add(new BasicNameValuePair("ep", ep));
      params.add(new BasicNameValuePair("rn", rn));
      params.add(new BasicNameValuePair("rxml", rxml));
  
     // create a consumer object and configure it with the access
     // token and token secret obtained from the service provider
      OAuthConsumer consumer = new CommonsHttpOAuthConsumer(consumerKey, consumerSecret);
      consumer.setTokenWithSecret(token, secret);
  
     // create an HTTP request to a protected resource
      HttpPost request = new HttpPost(uri);
  
     // sign the request      
      consumer.sign(request);       
  
     // set the parameters into the request
      request.setEntity(new UrlEncodedFormEntity(params));
  
     // send the request
      HttpClient httpClient = new DefaultHttpClient();
      HttpResponse response = httpClient.execute(request);
  
     //if request was unsuccessful
      if(response.getStatusLine().getStatusCode()!=200){
          return Response.status(response.getStatusLine().getStatusCode()).build();
      }
  
     //if successful, return the response body
      HttpEntity resEntity = response.getEntity();
      String responseBody = "";
  
      if (resEntity != null) {
          responseBody = EntityUtils.toString(resEntity);
      }
  
      EntityUtils.consume(resEntity);
  
      httpClient.getConnectionManager().shutdown();
  
      return Response.status(200).entity(responseBody).build();
  
  }
  </code></pre>
  
  <p>When I send a POST request to the server I get an error telling that the signatures (the one I send and the one the server calculates by itself) don't match, so I guess it has to do with the base string they are signing and the way the POST signing works, since they're handling the same keys and secrets in both sides (checked).</p>
  
  <p>I've read that a way to go through this is setting the parameters as part of the URL (as in a GET request). It wouldn't work for me though, since the XML parameter may exceed the URL length so it needs to be sent as a POST parameter.</p>
  
  <p>I suppose I'm doing something wrong either signing the POST requests or handling the parameters, but I don't know what it is. Please, could you help me out?</p>
  
  <p>P.S: I apologize if I lack context, error traces or additional information regarding this issue, but I'm newbie around here. So please don't hesitate to ask me for more information if you need it.</p>