OAuth 和 YouTube API

发布于 2024-11-25 02:26:01 字数 2074 浏览 3 评论 0原文

我正在尝试通过 OAuth 使用 YouTube 服务。我已经能够获取请求令牌、对其进行授权并将其转换为访问令牌。

现在我正在尝试使用这些令牌来实际向 YouTube 服务发出请求。例如，我正在尝试将视频添加到播放列表中。发出 POST 请求

因此，我向https://gdata.youtube.com/feeds/api /playlists/XXXXXXXXXXXX

发送主体

<?xml version="1.0" encoding="UTF-8"?>
<entry xmlns="http://www.w3.org/2005/Atom"
    xmlns:yt="http://gdata.youtube.com/schemas/2007">
  <id>XXXXXXXXX</id>
</entry>

和以及标头

Gdata-version: 2
Content-type: application/atom+xml
Authorization: OAuth oauth_consumer_key="www.xxxxx.xx",
                                oauth_nonce="xxxxxxxxxxxxxxxxxxxxxxxxx",
                                oauth_signature="XXXXXXXXXXXXXXXXXXX",
                                oauth_signature_method="HMAC-SHA1",
                                oauth_timestamp="1310985770",
                                oauth_token="1%2FXXXXXXXXXXXXXXXXXXXX",
                                oauth_version="1.0"
X-gdata-key: key="XXXXXXXXXXXXXXXXXXXXXXXXX"

以及一些标准标头（主机和内容长度），这些标头是在请求时由 urllib2 （我使用 Python）添加的。

不幸的是，我收到错误 401：未知授权标头，并且响应的标头

X-GData-User-Country: IT
WWW-Authenticate: GoogleLogin service="youtube",realm="https://www.google.com/youtube/accounts/ClientLogin"
Content-Type: text/html; charset=UTF-8
Content-Length: 179
Date: Mon, 18 Jul 2011 10:42:50 GMT
Expires: Mon, 18 Jul 2011 10:42:50 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

特别是我不知道如何解释 WWW-Authenticate 标头，其领域提示 ClientLogin。

我还尝试使用 OAuth Playground ，该网站发送的授权标头看起来完全像我的，除了字段的顺序。尽管如此，在游乐场上一切正常。好吧，差不多了：我收到一条错误，提示缺少开发者密钥，但这是合理的，因为无法在操场上添加开发者密钥。尽管如此，我还是跳过了错误 401。

我还尝试从那里手动复制授权标头，但我收到了错误 400：错误请求。

我做错了什么？

原文

I am trying to use the YouTube services with OAuth. I have been able to obtain request tokens, authorize them and transform them into access tokens.

Now I am trying to use those tokens to actually do requests to the YouTube services. For instance I am trying to add a video to a playlist. Hence I am making a POST request to

https://gdata.youtube.com/feeds/api/playlists/XXXXXXXXXXXX

sending a body of

<?xml version="1.0" encoding="UTF-8"?>
<entry xmlns="http://www.w3.org/2005/Atom"
    xmlns:yt="http://gdata.youtube.com/schemas/2007">
  <id>XXXXXXXXX</id>
</entry>

and with the headers

Gdata-version: 2
Content-type: application/atom+xml
Authorization: OAuth oauth_consumer_key="www.xxxxx.xx",
                                oauth_nonce="xxxxxxxxxxxxxxxxxxxxxxxxx",
                                oauth_signature="XXXXXXXXXXXXXXXXXXX",
                                oauth_signature_method="HMAC-SHA1",
                                oauth_timestamp="1310985770",
                                oauth_token="1%2FXXXXXXXXXXXXXXXXXXXX",
                                oauth_version="1.0"
X-gdata-key: key="XXXXXXXXXXXXXXXXXXXXXXXXX"

plus some standard headers (Host and Content-Length) which are added by urllib2 (I am using Python) at the moment of the request.

Unfortunately, I get an Error 401: Unknown authorization header, and the headers of the response are

X-GData-User-Country: IT
WWW-Authenticate: GoogleLogin service="youtube",realm="https://www.google.com/youtube/accounts/ClientLogin"
Content-Type: text/html; charset=UTF-8
Content-Length: 179
Date: Mon, 18 Jul 2011 10:42:50 GMT
Expires: Mon, 18 Jul 2011 10:42:50 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

In particular I do not know how to interpret the WWW-Authenticate header, whose realm hints to ClientLogin.

I have also tried to play with the OAuth Playground and the Authorization header sent by that site looks exactly like mine, except for the order of the fields. Still, on the plyaground everything works. Well, almost: I get an error telling that a Developer key is missing, but that is reasonable since there is no way to add one on the playground. Still, I go past the Error 401.

I have also tried to manually copy the Authorization header from there, and I got an Error 400: Bad request.