Signing message not correctly constructed according to 1btcxe rules

[d3brouille]

an order is not created on test_create_order because an attribute error is raised on getMoneys, a function from the MultiMoney class

example output:

======================================================================
ERROR: test_create_order (clients.TestAPI)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "clients.py", [line 59][https://github.com/deginner/bitcoin_exchanges/blob/master/test/clients.py#L58], in test_create_order
    if bal.getMoneys(mod.exchange.fiatcurrency) > Money(bid_price * bid_size, currency=mod.exchange.fiatcurrency):
AttributeError: 'unicode' object has no attribute 'getMoneys'

[d3brouille]

the underlying issue here is an authentication error:

{"errors":[{"message":"Invalid authentication.","code":"AUTH_INVALID_SIGNATURE"}]}

The send_request is implemented as described in 1btcxe's api spec

A ticket has been opened with 1btcxe to see if any additional insight can be gleaned from their server logs.

[d3brouille]

modified 'message' to match 1btcxe:

    def send_request(self, path, params=None, retry=0):
        if not params:
            params = {}

        urlpath = url + path
        headers = {"Content-type": "application/x-www-form-urlencoded"}
        params['api_key'] = self.key
        params['nonce'] = int(time.time() * 1000)
        # post_string = urllib.urlencode(params)

        # Hash the params string to produce the Sign header value
        message = bytes(json.dumps(params)).encode('utf-8')
        print message
        secret = bytes(self.secret).encode('utf-8')

        params['signature'] = hmac.new(secret, message, digestmod=hashlib.sha256).hexdigest()
        # hash_parm.update(post_string)
        print params
        print urlpath

        try:
            response = requests.post(url=urlpath, data=params, headers=headers, timeout=REQ_TIMEOUT).text
            print response

test run:

../bitcoin_exchanges/test/$ python -m unittest -v clients.TestAPI.test_get_balance

output:

{"nonce": 1446072231861, "api_key": "redacted"}
{'nonce': 1446072231861, 'api_key': 'redacted', 'signature': 'c9c8d8693570197bf7a2f66d9aae8398d4a582a6cfbe1cb6e6da0531c42e7cdb'}
https://1btcxe.com/api/balances-and-info
{"errors":[{"message":"Invalid authentication.","code":"AUTH_INVALID_SIGNATURE"}]}
{"errors":[{"message":"Invalid authentication.","code":"AUTH_INVALID_SIGNATURE"}]}
{"errors":[{"message":"Invalid authentication.","code":"AUTH_INVALID_SIGNATURE"}]}
test_get_balance 1btcxe
{"nonce": 1446072233621, "api_key": "redacted"}
{'nonce': 1446072233621, 'api_key': 'redacted', 'signature': '57d23380622471cca94aa9aebf2c98f7bf4883aa3da32b79517edbef4c861723'}
https://1btcxe.com/api/balances-and-info
{"errors":[{"message":"Invalid authentication.","code":"AUTH_INVALID_SIGNATURE"}]}
{"errors":[{"message":"Invalid authentication.","code":"AUTH_INVALID_SIGNATURE"}]}

additional output:

/local/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:100: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning

Note: I also tried removing 'headers' from the POST request, since 1btcxe makes no mention of headers in their spec. Same invalid authentication error was received.

[d3brouille]

Here is the link to the issue, I've yet to receive any feedback

1btcxe/wlox-api#66

[ergofobe]

I've tasked a PHP resource to work on this specific issue.. Hopefully we'll have a solution this week.

[d3brouille]

Thank you for the update.

[ergofobe]

@d3brouille we have pushed a proposed fix to the issue into our beta environment. Could you test your code against https://beta.1btcxe.com and see if it works? Please update 1btcxe/wlox-api#66 with the results of your testing. Thanks.

[ergofobe]

Ira a permanent fix will be worked on for a future release. We are going to
look at implementing JWS long term but that will break compatibility with
existing clients. This fix is intended to get things minimally working so
you can at least continue.
On Nov 19, 2015 1:19 PM, "Ira Miller" notifications@github.com wrote:

@d3brouille https://github.com/d3brouille please disregard... that
patch doesn't even look remotely like a real fix.

—
Reply to this email directly or view it on GitHub
#3 (comment)
.

[ergofobe]

@isysd. You're right, my dev tells me the bug he fixed was only loosely related and would not have solved this issue. @d3brouille we've submitted pull request #4 against your code which based on a working Java implementation. Please verify whether or not it works for you. I've also started a long-term issue 1btcxe/wlox#33 which will be to create a new version of the 1btcxe API using JWS message signing.