Oh boy.
After downloading your plnkr bundle and inserting a read-only application key set, I encountered an issue that required just one adjustment to receive a response stating:
{"request":"\/1.1\/statuses\/update.json","error":"Read-only application cannot POST."}
. Initially, the error message was
{"errors":[{"code":32,"message":"Could not authenticate you."}]}
.
Delete status: "hello" from within the curly brackets { } where you generate your signature.
signature = $cordovaOauthUtility.createSignature('POST', 'https://api.twitter.com/1.1/statuses/update.json', params, { }, twitter.consumer_secret, twitter.access_token_secret);
The request headers appeared as follows:
:authority:api.twitter.com
:method:POST
:path:/1.1/statuses/update.json
:scheme:https
accept:application/json, text/plain, */*
accept-encoding:gzip, deflate, br
accept-language:en-US,en;q=0.8
authorization:OAuth oauth_consumer_key="x",oauth_nonce="QFMmqiasFs",oauth_signature_method="HMAC-SHA1",oauth_token="y",oauth_timestamp="1496340853",oauth_version="1.0",oauth_signature="7Ts91LKcP%2FrYsLcF5WtryCvZQFU%3D"
content-length:18
content-type:application/json;charset=UTF-8
origin:http://localhost
referer:http://localhost/twits/
user-agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.98 Safari/537.36
Through some research, I came across a helpful tutorial: Displaying the Twitter Feed within Your Ionic App. Notably, the createTwitterSignature function demonstrated in this guide does not include parameters, which influenced my code adjustments.
function createTwitterSignature(method, url) {
var token = angular.fromJson(getStoredToken());
var oauthObject = {
oauth_consumer_key: clientId,
oauth_nonce: $cordovaOauthUtility.createNonce(10),
oauth_signature_method: "HMAC-SHA1",
oauth_token: token.oauth_token,
oauth_timestamp: Math.round((new Date()).getTime() / 1000.0),
oauth_version: "1.0"
};
var signatureObj = $cordovaOauthUtility.createSignature(method, url, oauthObject, {}, clientSecret, token.oauth_token_secret);
$http.defaults.headers.common.Authorization = signatureObj.authorization_header;
}
There seems to be differing opinions on whether additional parameters are necessary, but it appears that the signature serves as a foundational access point rather than hashing every operation - refer to Understanding Request Signing For Oauth 1.0a Providers.