Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.SHA1 is the signature method mentioned in the OAuth 1.0 specification and is the by far most widely used signature method among OAuth API:s.
Our OAuth module instead has SHA512 as default and we're pretty unique to have it that way. Even OAuth 2.0 is only suggested to have SHA256.
To make the OAuth module behaving more in line with the rest of the OAuth world I suggest we change the default signature method for the OAuth 1.0 to be the one mentioned in its specification - SHA1. This should be causing less confusion when trying to consume other API:s as well as when others are trying to consume our API:s.
Any thoughts? Would this be a good or a bad change?
Comments
Comment #1
voxpelli CreditAttribution: voxpelli commentedNeed to get this in prior to stable release - if anyone objects, now is the time to say so.
Comment #2
litwol CreditAttribution: litwol commentedThis have been over a month now. set the new default and lets close this.
Comment #3
voxpelli CreditAttribution: voxpelli commentedFixed: http://drupalcode.org/project/oauth.git/commit/f84dcc1