Currently OAuthMessages are containing a nonce that is generated from System.nanoTime(). This is an unfortunate choice, given that OAuth spec requires the timestamp+nonce combination to be unique.

The javadoc says about nanoTime: "This method provides nanosecond precision, but not necessarily nanosecond resolution (that is, how frequently the value changes) - no guarantees are made except that the resolution is at least as good as that of currentTimeMillis()."

If we take this into account, the chances are very likely that timestamp and nonce will collide.

What steps will reproduce the problem? 1. create a multi-threaded application that uses net.oauth (e.g. jmeter) 2. run with many threads in parallel generating oauth-signed messages 3. see 401 Unauthorized errors popping up, as there is a good chance that nonce/timestamp contain duplicates.

What is the expected output? What do you see instead? I want to see a reduced chance of colliding timestamp+nonce combinations. To do so we need to change the nonce generation to ensure uniqueness / randomness. Suggestion would be to use UUID.randomUUID()

What version of the product are you using? On what operating system? 20100527 via maven.

Please provide any additional information below. I found this issue while analyzing OAuth failures using the oauth-jmeter plugin. So I forked the project from https://github.com/captrespect/jmeter-oauth into https://github.com/otrosien/jmeter-oauth and issued a pull request to reorganize and improve the code. If you can tell me where I can issue a pull request to this issue, please do so, and I'll be happy to provide a patch.

Forgot to mention: I'm using java7 64bit on a windows7 box.

read http://shipilev.net/blog/2014/nanotrusting-nanotime/ for granularity of nanotime on windows.