HTTP Redirection broken

[daurnimator]

You can't use redirection with https and luasocket.

Fix:
Add redirect = false to request_constructor

Just after doing the http(s) request:
if response_code == 301 or response_code == 302 then
-- TODO: Add redirection loop detection
return PerformRequestHelper ( self , response_headers.location , method, headers, arguments, post_body)
end

[daurnimator]

just noticed the fix I advised above breaks with a GET request: it appends the query string again for each request.
i've done a hack fix by nil-ing out arguments in the GET branch...

[daurnimator]

and then again; I notice that now the signature is broken; will have to do a completely new request.
fix will be more complicated than I first thought

[ignacio]

Do you have an example of such an OAuth api that does that? (I mean, returning 301 or 302 for a request). I never came across one.

[daurnimator]

LivePerson
See:
http://community.liveperson.com/docs/DOC-1033
http://community.liveperson.com/docs/DOC-1044#base

at the moment I've got it working by adding redirect = false in codeLuaSocket.lua table constructor for request_constructor
and using the code:

local url = "https://api.liveperson.net/api/account/" .. accountID

local response_code, response_headers, response_status_line, response_body
while true do
    response_code, response_headers, response_status_line, response_body = c:PerformRequest("GET" , url , { v= "1" } )

    if response_code >= 200 and response_code < 300 then
        break
    elseif response_code == 301 or response_code == 302 then
        url = response_headers.location:match("[^?]+")
    else
        error ( "FAIL" )
    end
end

[daurnimator]

I think the best solution would be to add the redirect = false
then in OAuth.lua rewrite Sign to use socket.url.parse
As a note; you also don't do anything with port number.

[ignacio]

Ok, I'll take a look at it. If you have a pull request, that would be great.

[daurnimator]

in the mean time before you have a proper fix just add the redirect = false.
It'll at least return 301/302 instead of a cryptic error message from openssl about version numbers.