[BUG] Twitter kit iOS 3.0.4 authenticating with Twitter app installed

_paulbuchanan · 2017-06-29T21:56:28.010Z

When authenticating with iOS Twitter kit 3.0.4, when Twitter version 7.3.2 is installed, I’ve noticed issues with the Twitter app holding onto the last OAuth application that has authenticated. Steps

Authenticate with application 1
Control is handed off to Twitter, OAuth screen showing Application 1 wanting a connection
User accepts, control is handed back to application 1, which is now authenticated
Launch application 2, and attempt to authenticate
Control is handed off to Twitter, OAuth screen incorrectly shows Application 1 wanting a connection
If user accepts, session that is established is invalid, and will not work because the headers are for Application 1!
Kill twitter app
Back in application 2, attempt to authenticate again
Control is handed off to Twitter, OAuth screen now correctly shows Application 2 wanting a connection
User accepts, control is handed back to application 2, which is now correctly authenticated

Seems like the Twitter app is holding onto the last application information that has authenticated, and is not using the information for the current authenticating app.

This is a major bug.

katejaiheelee · 2017-06-29T22:27:00.295Z

Thank you for reporting this. We are working with the main Twitter app engineers.

bobbydharrell · 2017-07-07T14:27:13.731Z

We are having the same issue. Any news on a fix for this yet?

katejaiheelee · 2017-07-07T17:27:18.481Z

Engineers in the main app are working on it. We hope to fix it soon and ship it with bi-weekly Twitter app release this month.
This won’t require Twitter Kit update though.

_paulbuchanan · 2017-07-28T17:02:03.581Z

Problem still exists with Twitter Kit 3.0.4 and Twitter app 7.3.2

DrAL3X · 2017-08-03T10:23:57.344Z

@katejaiheelee the problem still exists with TwitterKit 3.0.4 and Twitter app 7.4

To fix it properly each app needs to specify a unique app URL scheme so that the Twitter app will be able to forward login data back to the correct one. A simple (and backward compatible solution) is to support URL scheme suffix. This way application 1 and 2 have different URL schemes and this problem will never happen again.
Facebook SDK does the same, so it’s a solid solution.

Related bug and solution discussed here

TwitterKit 3.0.3 - share same twitter app (consumer key and secret) between multiple apps Twitter Kit SDK

Hi there, we have an online platform that is used by several iOS apps. All of them can sign in the user authenticated via Twitter. This requires using the same (twitter) consumer key and secret across all iOS apps. This creates a problem now that the consumer key is added to the Info.plist to redirect the user from the Twitter app back to the calling app. We can have multiple apps installed on the phone with the same URL scheme. Is it possible to differenciate the URL scheme in any way? Face…

Please take this in consideration “quickly”. With iOS11 there is no other way of authenticate user that using TwitterKit and now it’s clearly broken.

katejaiheelee · 2017-08-03T18:56:18.590Z

I can’t reproduce this bug anymore with 7.4
Could you confirm?

Other two bugs are still in progress.

bobbydharrell · 2017-08-03T19:13:48.469Z

This is fixed for us, Thank you!!

_paulbuchanan · 2017-08-07T16:14:43.626Z

Looking good now with Twitter 7.4. Thanks for the fix!

katejaiheelee · 2017-08-10T18:08:55.008Z