OAuth 2.0 server-side flow

lucas42 · 2011-11-20T10:46:37.000Z

I’ve been having a look at authenticating using OAuth 2.0. I know it’s not offically supported, but there is an endpoint which @Anywhere uses.

Does anyone know if it’s possible to get this endpoint to use the server-side flow, rather than the client-side flow? With normal OAuth 2.0 it is just a case of changing response_type=token to response_type=code. However, twitter doesn’t use standard parameters, it just makes up its own. For client-side flow the relevant parameter is oauth_mode=flow_web_client, but I can’t find what this should be for server-side flow.

Also, it seems that if this parameter is left out, twitter defaults to using client-side flow; unlike facebook, which defaults to server-side.

Any ideas?

episod · 2011-11-21T16:21:46.000Z

We don’t support OAuth 2 beyond what is documented in @Anywhere. Please don’t try to use the end points for anything other than @Anywhere.

movefi · 2011-11-27T16:52:12.000Z

Is there a timeframe for implementing oAuth2. oAuth1 is a pain…

episod · 2011-11-28T16:28:03.000Z

There is no timeframe to announce. OAuth2 is also a pain.

lucas42 · 2011-11-28T16:52:27.000Z

OAuth2 is much less of a pain than OAuth1. There’s no signing or anything to worry about.

It is already supported by Google, Facebook and others - it would be nice if twitter caught up, so we could authenticate with all these services in the same way, rather than having to write a special case for twitter.

YodasWS · 2011-12-05T01:21:05.000Z

I concur with @lucas24 on this matter. I’ve spent the past few days adding OAuth 2.0 support with Facebook, Google+, and soon Windows Live. Twitter would make it a trifecta (obviously Windows Live doesn’t count for anything).

Paolo_Mariotto · 2011-12-05T10:05:42.000Z

it would be great to have some examples on how to use server-side flow to post new direct messages or other post requests. (PHP)

fridgetofood · 2011-12-28T19:58:00.000Z

I’m going to join in with those requesting OAuth 2.0 support. It’s time for twitter to catch up with the rest of the internet. I don’t like writing special cases.

danjellz · 2012-01-15T16:45:04.000Z

Also requesting OAuth2 support. Much easier to implement.

kurrik · 2012-01-17T22:24:43.000Z

How are you planning on using Twitter’s API without writing any special cases?

fridgetofood · 2012-02-12T16:16:05.000Z

Easy. With OAuth2 the basic server calls and response handling is the same across all services that support it – which is most of the big OAuth providers at this point. I, as the client, can write a base class to perform them and then just pass the appropriate URLs and client keys from a parent class. Much less code. As it stands Twitter needs an entire Auth class to itself with completely separate (and much more extensive) mechanics.

kurrik · 2012-02-13T21:07:09.000Z

I’m not sure I believe it. Facebook’s documentation says nothing about refresh tokens, for example: http://developers.facebook.com/docs/authentication/

While Google’s docs devote a large amount of attention to using refresh tokens, which require a whole new step in the auth flow: http://code.google.com/apis/accounts/docs/OAuth2WebServer.html

Each set of docs also present a bunch of unique parameters and response data. I doubt an integration which used both could abstract away a large amount of the differences between these two approaches, at least to the point where you’re just adding a set of credentials to enable a new service.

aseemk · 2012-03-04T18:07:48.000Z

Would also really like this. Our use case is a simple “Find your friends” [who’re using our app] feature.

We’re obviously not going to query the database directly from the web client, so it’s greatly inconvenient that we can only fetch a user’s friends from the client (since a user’s Twitter account could be protected, and we can only get the user’s OAuth token on the client!).

As it stands, we have to thus either transmit the user’s OAuth token, or the list of their Twitter friends, across the wire – unencrypted – to our server. Neither is secure. A server-side OAuth flow would prevent this security hole.

klebba · 2012-04-17T06:54:35.000Z

Can you provide a reason why OAuth 1.0 is better than OAuth 2.0 from the perspective of an API user? I can’t. The 2.0 protocol is easier to implement, thats why it exists. From the Wikipedia article:

“OAuth 2.0 focuses on client developer simplicity”

Arguing against this reality is absurd.

en.wikipedia.org

OAuth

OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords. This mechanism is used by companies such as Amazon, Google, Facebook, Microsoft and Twitter to permit the users to share information about their accounts with third party applications or websites. Generally, OAuth provides to clients a "secure delegated access" to server resources on behalf...

stackoverflow.com

OAuth 2.0: Benefits and use cases — why?

oauth, oauth-2.0

asked by tonyhb on 09:37PM - 26 Sep 11

sslytestuser · 2012-04-19T07:35:14.000Z

any update on OAuth 2.0 server-side flow support by twitter?

siylc · 2012-05-10T16:08:14.000Z

In the beginning twitter worked so hard to get people to use it. I have implimented it into numerouse websites in the past using the BASIC Authentication back when it was supported.

They then remove BASIC Authentication and replace it with the highly complex oAuth1. As result all of my websites which used twitter don’t use it in any way as I am not prepared to mess about with the stupid oAuth1 (Wasted too much time trying to get it to work already).

Twitter is the only Social Network with an API which I don’t try and sell/promote to my clients due to this. I am sure one day when twitter eventually do something about supporting oAuth2 I may come back but untill then I shall forget all about twitter.

The big question is what happens first? OAuth2 or Twitter being worthless (MySpace)?

yumedev · 2012-06-21T19:28:35.000Z

+1 for Oauth2, get with it

Spin7ion · 2012-07-05T09:44:30.000Z

Need OAuth 2.0. It’s pretty much easy and secure

lflacroix · 2012-07-18T08:17:12.000Z

Is this a joke? Still no support for oauth2

almadcz · 2012-07-24T13:43:55.000Z

+1 for oauth2 support