Magento 2 REST API Endpoint /V1/stockItems/:productSku is encountering a bug specifically when using OAuth 1.0 authentication. The issue arises when the product SKU contains special characters such as slashes (/) or ampersands (&). This results in an incorrect OAuth signature being generated, leading to errors in the authentication process.
The error is being triggered from the class Magento\Framework\Oauth\Oauth::_validateSignature() at line number 207. The root cause of the problem lies in the signature generation process, which is performed by the Laminas library. The library generates different signatures for SKUs containing slashes or ampersands, causing inconsistencies in the authentication flow.
Example:
Working URL: https://test.com/test-sku
Not Working URL: https://test.com/test-sku%2F123
The correct OAuth signature generation for the product SKU is not taking into account the special characters, leading to an incorrect signature that fails the authentication process.
To fix this issue, adjustments need to be made in the OAuth signature generation logic, ensuring that it properly handles SKUs with special characters and produces consistent signatures for all SKU variations.
Please see below screenshot for more reference.
Steps to reproduce
- Login to Magento admin. Navigate to System > Extensions > Integrations > Add New Integration.
- Activate Added Integration from the Integration grid with all rights.
- Go to the Catalog > Product. Add or edit product.
- Keep sku name "demo-test/1234" or demo-test&1234 Save product.
- Go to Postman.
- Set Get Request with endpoint rest/V1/stockItems ex:- https://your-domain/index.php/rest/V1/stockItems/demo-test%2F1234
- Set Oauth 1.0 Set Add authorization data to Request Headers.
- Set Integration details in the OAuth request like consumer key, Access Token etc etc.
- Send request
GitHub Issue link:- https://github.com/magento/magento2/issues/37830
