Re: oauth no longer works with Twitter

[George Ludwig]

I resolved the issue...it's a little difficult to explain, but in the end it was my issue, rather than an issue with the library.

On Thursday, April 4, 2013 3:14:27 PM UTC-7, George Ludwig wrote:

Within the last day, Twitter now requires a callback url. Per this discussion ( https://dev.twitter.com/discussions/16443 ):

"There are two aspects to the change -- both are mandatory parts of the OAuth 1.0A spec that we've been lenient with in the past:

You must pass an oauth_callback value to oauth/request_token. It's not optional. Even if you have one already set on dev.twitter.com. If you're doing out of band OAuth, pass oauth_callback=oob.

You must pass along the oauth_verifier you either received from your executed callback or that you received hand-typed by your end user to oauth/access_token."

I could not find a way to directly pass the callback url when also using the oauth verifier. So I tried adding it:

OAuthConsumer consumer = new DefaultOAuthConsumer(getApiKey(),getConsumerSecret());

consumer.setTokenWithSecret(oauthToken, tokenSecret);

DefaultOAuthProvider provider = new DefaultOAuthProvider("https://api.twitter.com/oauth/request_token", "https://api.twitter.com/oauth/access_token", "https://api.twitter.com/oauth/authorize");

String[] callbackURL=new String[2];

callbackURL[0]=OAuth.OAUTH_CALLBACK;

callbackURL[1]="http://dev.6builder.com/authenticate";

provider.retrieveAccessToken(consumer, oauthVerifier,callbackURL);

But it still fails. This may be related to the "retrieveRequestToken custom parameters" issue.

This is a deal breaker. I've got a couple of hundred users who cannot sign in to my app. If anyone is listening, please respond. 

[Henry Katz]

Hi George,

Could you share some of what your insights were to resolve this issue? I am receiving a 401 authorization error using the demo twitter/oauth example code on:

https://code.google.com/p/oauth-signpost/wiki/TwitterAndSignpost

using their zip:

http://oauth-signpost.googlecode.com/files/OAuthTwitterExample.zip

I did edit the code to use my consumer key/secret.

Thanks,
Henry

[George Ludwig]

My original screwup was way too obscure to describe, and was actually a security hole in twitter's oauth that I was unknowingly exploiting.

More recently, I noticed that the oauth callback URL in the request must match the one registered with twitter. Previously, twitter ignored the callback URL supplied with your request, and instead used the one set up in the application API settings. So you could have been supplying the wrong callback URL in the request, yet it would still work because Twitter used the one you had registered. Just recently, that changed.

Does that make sense?

--
You received this message because you are subscribed to the Google Groups "Signpost users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to signpost-user...@googlegroups.com.
To post to this group, send email to signpos...@googlegroups.com.

Visit this group at http://groups.google.com/group/signpost-users.
For more options, visit https://groups.google.com/d/optout.

[Henry Katz]

Thanks for the tip. Will look into the callback URL angle even though I do not recall setting that value in the twitter dev page for the app.

You received this message because you are subscribed to a topic in the Google Groups "Signpost users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/signpost-users/MU59P9zNI5Y/unsubscribe.
To unsubscribe from this group and all its topics, send an email to signpost-user...@googlegroups.com.