OpenSocial Signed Request is a mechanism that adds a signature to external communication requests from gadgets, making it possible to verify that the parameter contents have not been tampered with. Terms like 2-legged OAuth, Signed Request, and OAuth Consumer Request all generally refer to this exact same thing.

While the implementation itself is not difficult at all, there didn't seem to be many handy libraries available, so I decided to build one. I'm releasing it as a beta to start with.

Features #

It uses the OAuth library on Google Code. It bundles public keys for orkut, Google, Friendster, hi5, hyves, Netlog, as well as goo Home and mixi.

Usage #

Please check it out from Google Code:

svn checkout http://opensocial-signed-request-php-library.googlecode.com/svn/trunk/ opensocial-signed-request-php-library-read-only

Inside, you will find a sample gadget (SignedRequest.xml), a sample server-side implementation (example.php), and the library itself.

Looking at the sample server-side implementation is the fastest way to understand it, but the usage is simple. Just instantiate SignedRequestValidator with the gadget URL as an argument, and call the validate_request method. If signature verification fails, it will automatically return a 401. If signature verification succeeds, you can simply write your code right after that.

References #

As far as I know, several others have published code and libraries to verify Signed Requests in other languages:

  • gaeoauth, running on Django for Google App Engine Python
  • Code running on Google App Engine Python
  • mod_auth_opensocial, running at the Apache module level

Summary #

Although this is a beta release, there shouldn't be any operational issues. However, with the code as-is, requests from both Google and mixi will pass as long as the gadget URL matches, so I'd like to gather feedback to decide whether making provider specification optional or configurable is desirable.

  • By the way, oauth_body_hash is not yet supported.

So please, give it a try!