in src/main/java/com/twitter/joauth/UnpackedRequest.java [351:374]
public void verify(Request.ParsedRequest parsedRequest, OAuthParams.OAuth1Params oAuth1Params) throws MalformedRequest {
if (parsedRequest.scheme() == null) throwMalformedException(SCHEME);
else if (parsedRequest.host() == null) throwMalformedException(HOST);
else if (parsedRequest.port() < 0) throwMalformedException(PORT);
else if (parsedRequest.verb() == null) throwMalformedException(VERB);
else if (parsedRequest.path() == null) throwMalformedException(PATH);
else if (oAuth1Params.signatureMethod() == null ||
!oAuth1Params.signatureMethod().equals(OAuthParams.HMAC_SHA1) &&
!oAuth1Params.signatureMethod().equals(OAuthParams.HMAC_SHA256)) {
throw new MalformedRequest(UNSUPPORTED_METHOD + oAuth1Params.signatureMethod());
}
else if (oAuth1Params.version() != null &&
!oAuth1Params.version().equals(OAuthParams.ONE_DOT_OH) &&
!oAuth1Params.version().toLowerCase().equals(OAuthParams.ONE_DOT_OH_A)) {
throw new MalformedRequest(UNSUPPORTED_VERSION + oAuth1Params.version());
}
else if (oAuth1Params.token() != null &&
(oAuth1Params.token().indexOf(' ') > 0 || oAuth1Params.token().length() > MaxTokenLength)) {
throw new MalformedRequest(MALFORMED_TOKEN + oAuth1Params.token());
}
// we don't check the validity of the OAuthParams object, because it must be
// fully populated in order for the factory to even be called, and we'd like
// to save the expense of iterating over all the fields again
}