This is cl-oauth, an implementation of the OAuth 1.0a standard in Common Lisp. Spec URI: http://oauth.net/core/1.0a Section numbers mentioned in the code and documentation refer to this document, unless mentioned otherwise. Most of the code has passed basic manual and automated tests, but the SP code hasn't been used in a real-world application yet. Not supported at this time: Service Provider: * parameters from Auth header (needs some parsing) [5.4] in principle a MUST, but as SP you get to decide ;) * Nonce checking [9], a SHOULD. * Session extension http://oauth.googlecode.com/svn/spec/ext/session/1.0/drafts/1/spec.html * Problem Reporting extension http://oauth.pbworks.com/ProblemReporting Consumer: * Auth parameters should be working, but Google rejects them for some reason. Do more testing and debugging. * Revoking tokens as per section 7 of the Session extension * Problem Reporting extension: fields in body are ignored. Both: * crypto signatures different from HMAC-SHA1. It's easy to use other digests and MACs via Ironclad but RSA needs to have padding implemented. [9.3] * PLAINTEXT signature. Meh. [9.4] * POST and Auth requests are hardly tested yet. People who contributed in a substantial way to this library: * Leslie P. Polzer <polzer@port-zero.com>: base implementation. See also revision log for minor contributions. TODO (apart from spec things not implemented yet): * grep the code for TODO and FIXME * incorporate test cases from http://wiki.oauth.net/TestCases * abstract token storage, can't get far with volatile memory FETCH-TOKEN/STORE-TOKEN * better handling of different protocol versions; in particular we should support serving both 1.0 and 1.0a clients (and requesting stuff from 1.0 and 1.0a servers too, of course). * compare with the Hammer draft spec and resolve differences * always store the URL-decoded key/secret in the request token