René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Pass appsecret_proof as a query string parameter as it maybe be ignored if passed in as a body parameter","articleBody":"Specifically for some POST requests in current implementation we get API calls from the server require an appsecret_proof argument response. Some POST endpoints will send the HTTP body with form encoded data, which would mean the body parameters are ignored.\r\n\r\nTangibly related it may be worth also implementing it following https://developers.facebook.com/docs/facebook-login/security/#proof (using timestamp in proof computation is not enforced but recommended by FB)\r\n\r\n      // See https://developers.facebook.com/docs/facebook-login/security/#proof\r\n      var appsecretTime = TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis());\r\n      final String appsecretProofPlain = accessToken + \"|\" + appsecretTime;\r\n      for (byte b : mac.doFinal(appsecretProofPlain.getBytes())) {\r\n        appsecretProof.format(\"%02x\", b);\r\n      }\r\n      request.addQuerystringParameter(\"appsecret_proof\", appsecretProof.toString());\r\n      request.addQuerystringParameter(\"appsecret_time\", String.valueOf(appsecretTime));\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/2f67d748-e654-4b6c-9858-9657f2c1e5bf)\r\n","author":{"url":"https://github.com/kullfar","@type":"Person","name":"kullfar"},"datePublished":"2024-09-29T13:47:45.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/1073/scribejava/issues/1073"}