{"record":{"id":"6bd767dcd4a010cf","repo":"usebruno/bruno","slug":"unsupported-oauth1-signature-method-method","errorCode":null,"errorMessage":"Unsupported OAuth1 signature method: ${method}","messagePattern":"Unsupported OAuth1 signature method: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/bruno-requests/src/auth/oauth1-request-authorization.ts","lineNumber":208,"sourceCode":"        'RSA-SHA256': 'RSA-SHA256',\n        'RSA-SHA512': 'RSA-SHA512'\n      };\n      const signer = crypto.createSign(algoMap[method]);\n      signer.update(baseString);\n      return signer.sign(privateKey, 'base64');\n    }\n\n    case 'HMAC-SHA512':\n      return crypto.createHmac('sha512', key).update(baseString).digest('base64');\n\n    case 'HMAC-SHA256':\n      return crypto.createHmac('sha256', key).update(baseString).digest('base64');\n\n    case 'HMAC-SHA1':\n      return crypto.createHmac('sha1', key).update(baseString).digest('base64');\n\n    default:\n      throw new Error(`Unsupported OAuth1 signature method: ${method}`);\n  }\n}\n\n// Body Hash (draft-eaton-oauth-bodyhash-00)\n// https://datatracker.ietf.org/doc/id/draft-eaton-oauth-bodyhash-00.html\nexport function computeBodyHash(body: string, signatureMethod: SignatureMethod): string {\n  const algoMap: Record<string, string> = {\n    'HMAC-SHA512': 'sha512',\n    'HMAC-SHA256': 'sha256',\n    'RSA-SHA512': 'sha512',\n    'RSA-SHA256': 'sha256'\n  };\n  const algo = algoMap[signatureMethod] || 'sha1';\n  return crypto.createHash(algo).update(body).digest('base64');\n}\n\n/**\n * OAuth 1.0 authorization library (RFC 5849).","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/usebruno/bruno/blob/9bdd81c7bdc57006e5f5ebffb79321a8d979f712/packages/bruno-requests/src/auth/oauth1-request-authorization.ts#L190-L226","documentation":"Thrown by the OAuth1 signer's defaultHashFunction switch when `method` does not match any known case (PLAINTEXT, RSA-SHA1/256/512, HMAC-SHA1/256/512). The default branch rejects unknown values so an unsupported algorithm cannot silently produce a weak or invalid signature.","triggerScenarios":"Configuring signature_method with a typo or unsupported value such as 'HMAC-MD5', 'RS256', 'rsa-sha256' (wrong casing), 'HMAC-SHA384', or undefined.","commonSituations":"Copy-pasted a JWT alg name (RS256, HS256) into the OAuth1 config; casing mismatch (the switch is case-sensitive); trailing whitespace in the value; an old collection carrying a now-retired method.","solutions":["Use one of the supported values exactly: PLAINTEXT, HMAC-SHA1, HMAC-SHA256, HMAC-SHA512, RSA-SHA1, RSA-SHA256, RSA-SHA512.","Trim whitespace and verify casing before passing the value.","If you need a method not listed, fall back to HMAC-SHA1 (the OAuth1 default) or extend the signer deliberately."],"exampleFix":"// before\nconst authorizer = createOAuth1Authorizer({\n  consumer: { key, secret },\n  signature_method: 'RS256' // JWT alg name, not OAuth1\n});\n\n// after\nconst authorizer = createOAuth1Authorizer({\n  consumer: { key, secret },\n  signature_method: 'RSA-SHA256'\n});","handlingStrategy":"type-guard","validationCode":"const SUPPORTED = new Set(['PLAINTEXT','HMAC-SHA1','HMAC-SHA256','HMAC-SHA512','RSA-SHA1','RSA-SHA256','RSA-SHA512']);\nfunction assertMethod(m) {\n  if (!SUPPORTED.has(String(m).trim())) throw new Error('unsupported signature method: ' + m);\n}","typeGuard":"const isSupportedMethod = (m) => typeof m === 'string' && SUPPORTED.has(m.trim());","tryCatchPattern":"try { authorizer.authorize(req); }\ncatch (err) {\n  if (/Unsupported OAuth1 signature method/.test(err.message)) {\n    config.signature_method = 'HMAC-SHA1'; // safe default\n  } else throw err;\n}","preventionTips":["Use the exact supported spelling and casing.","Do not confuse JWT alg names (RS256/HS256) with OAuth1 methods.","Trim whitespace from config values."],"tags":["bruno-requests","auth","oauth1","validation","config"],"backgroundTag":null,"analyzedSha":"9bdd81c7bdc57006e5f5ebffb79321a8d979f712","analyzedAt":"2026-08-13T04:09:25.751Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}