Twitter Oauth URL encoding inconsistencies? -

I am reading walkthrough, but callback seems to be an incompatibility in url encoding. Callback is listed as follows:
oauth_callback -

sign base is listed as a string:
post ... oauth_callback% 3D http% 253A% 252F % 252 Flokalohost% 253A3005% 252Fthe_dance% 252Fprocess_callback% 253Fservice_provider_id% 253D11 % 26oauth_consumer_key% 3D ...

callback here appears to be double encoded.

The signed authority header is listed as:
OAuth oauth_nonce = "QP70eNmVz8jvdPevU3oJD2AfF7R7odC2XJcn4XlZJqk", oauth_callback = " http% 3A% 2F% 2 flacollehost% 3A3005% 2Fthe_dance% 2Fprocess_callback% 3Fservice_provider_id% 3D11 ", ...

Here, the callback single URL appears encoded. Why are they not compatible?

encoding is not inconsistent, the URL is simply being used in two with two different requirements Different situations

The URL stops un-encoded in your app. The second example you posted is a value that will be given as a header, so it should be URL-encoded (this is a one time).

The signed authority header is listed as: OAuth Oauth_nonce = "QP70eNmVz8jvdPevU3oJD2AfF7R7odC2XJcn4XlZJqk", oauth_callback = "http% 3A% 2F% 2 flacollehost% 3a 3005% 2Fthe_dance% 2Fprocess_callback% 3Fservice_provider_id% 3D11" , ...

Then, to create the original string to sign the value of all, the header header parameter should be associated with other required values. The original string is created from values ​​in the they are sent to the server If you are taking the price you're going through the server, you have already encoded URL, and other Values ​​are combining, each of which should be encoded in the URL, & amp; .

You can see why it should be, because the base-string contains the query parameters in the third section, which already URL encoded (eg oauth_callback ) values Uses and & amp; as a separator to combine this query parameter list ( & amp; ) securely in the base string (also & amp; Using it as a separator), it is re-concatenated before having the URL. At this point, oauth_callback has been encoded twice in itself, and once as part of the combined value:

signature base string Listed as: Post & amp; ... oauth_callback% 3Dhttp% 253A% 252F% 252 Flokallost% 253 A 3005% 252% Fadi_dens 252 Fcrosaclabak% 253Fservice_provider_id% 253D11% 26oauth_consumer_key% 3D ...