[twitter-dev] what's wrong with my xAuth code ???

[mostafa farghaly]

every time i get "failed to validate outh token and signature" :(
here's my simple code

                        var username = "username",
                                password = "password",
                                url= 
"https://api.twitter.com/oauth/access_token";,
                                key = "key",
                                timestamp = +new Date,
                                nonce = "thisismynoncce" + timestamp;

                var access_token = "oauth_consumer_key=" + key +
                        "&oauth_nonce=" + nonce +
                        "&oauth_signature_method=HMAC_SHA1" +
                        "&oauth_timestamp=" + timestamp +
                        "&oauth_version=1.0" +
                        "&x_auth_mode=client_auth" +
                        "&x_auth_password=" + password +
                        "&x_auth_username=" + username;

                        var base_string = "POST&" + encodeURIComponent(url) + 
"&" +
encodeURIComponent(access_token);

                        var oauth_signature = b64_hmac_sha1("token_secret&", 
base_string);


                        var auth_header = 'OAuth oauth_nonce="' + nonce + '"' +
                        ', oauth_signature_method="HMAC-SHA1"' +
                        ', oauth_timestamp="' + timestamp + '"' +
                        ', oauth_consumer_key="' + key + '"' +
                        ', oauth_signature="' + oauth_signature + '"' +
                        ', oauth_version="1.0"';


                      $.ajax({
                                url:url,
                                method: "POST",
                                data: {
                                        x_auth_username: username,
                                        x_auth_password: password,
                                        x_auth_mode: "client_auth"
                                },
                                beforeSend: function(xhr){
                                        xhr.setRequestHeader("Authorization", 
auth_header);
                                },
                                success: function(data){
                                        alert(data);
                                },
                                error: function(xhr){
                                        alert(xhr.responseText);
                                }
                        })