Oauth/access_token Stopped working today

Ramanean · 2013-04-05T01:55:02.000Z

One of the worst changes…Why can’t you let us know before making these changes?It should have been informed to us atleast 1 week in advance.

Most of the twitter apps won’t work…except few devs others won’t even know where to add this…Way to go twitter!! Though twitter started as small platform now it’s a very big one and used everywhere…Impact analysis should have been done before doing a change like this.

Ramanean · 2013-04-05T01:54:42.000Z

Most of the twitter apps won’t work…except few devs others won’t even know where to add this…Way to go twitter!! Though twitter started as small platform now it’s a very big one and used everywhere…Impact analysis should have been done before doing a change like this.

CyG_ONE · 2013-04-05T10:33:02.000Z

could you please give us some hint on how to update the abraham library to make these new ‘rules’ work ?

thank you

CyG_ONE · 2013-04-05T10:40:05.000Z

using the abraham lib with php …
simply changed
this
// $token = $connection->getAccessToken();
into
$token = $connection->getAccessToken($_REQUEST[‘oauth_verifier’]);

and it works again …

happy coding everyone

twitnutttt · 2013-04-05T11:24:45.000Z

+1. WTF, Twitter? You don’t even document or announce a change like this AFTER the fact? Let alone provide advance notice?! We have a 3rd party library that does not support this, and since you provided no notice, we and anyone else using it are F*ed up.

sameeh_harfoush · 2013-04-05T14:34:07.000Z

Dear Taylor Singletary,
what you can do is select all twitter accounts that contain applications and send them an email with the above changes a couple of weeks before so we can develop the patch, test it, and deploy it so we avoid application crash. moreover, this way twitter servers wont get flooded with 401 exceptions

Thank you

kwkasi · 2013-04-05T16:14:05.000Z

Why do you say this?: Additional reminder: Scraping a PIN code/oauth_verifier from the HTML page that displays it in out of band OAuth is very very uncool.

It makes it easier for the end user… If you add restrictions in this aspect please let us know in advance, we follow @twitter_api and are subscribed to Twitter developer blog…

Thank you

episod · 2013-04-05T16:28:57.000Z

There’s really no advance notice we would give on this – as the expectation is already that you aren’t scraping the PIN code, as it’s a total violation of the spirit of OAuth.

I know you perceive it as “easier” but it doesn’t really matter what experience you want to provide to your users, the specific OAuth flow is there for a reason.

Tokens obtained through this means have always been forbidden and if you had any apps that used scraping of the PIN would be subject to suspension with all access tokens revoked – if you’re taking this approach, there’s no way for us to continue to consider those access tokens as validly obtained.

SwiitApps · 2013-04-05T16:30:49.000Z

We are using Reverse OAuth in our iOS 6.0/5.0 app and we are affected too.

Any tips for app like ours.

VecniDecak · 2013-04-05T16:46:46.000Z

+9999999 @sameeh_harfoush

jimio · 2013-04-05T19:49:55.000Z

hi all,

@jimio here from the Product Security team at Twitter. the situation in which this change was made was less than ideal, and as a result, the communication wasn’t up to par with that of other changes to the API. as you know, the oauth_verifier parameter was added to the 1.0a OAuth spec to address a session-fixation security issue. some practical attacks against this weakness had come to light, and we flipped the bit to enforce this check in order to protect our users. this was the sort of nonstandard scenario in which we make an urgent change in order to address something that could quickly turn into a major issue.

thank you.
_jim

garrettmurray · 2013-04-05T20:00:23.000Z

Makes sense, definitely, but I think it’d be a good idea to post something about this somewhere so that other folks who hit this bug don’t have to search all day like I did trying to figure out why. I have a feeling many, many apps will be affected by this so perhaps you should announce this change publicly.

Krunal_etech · 2013-04-06T08:44:47.000Z

Hi All,

I am a iOS developer and naive to iOS as well Twitter, I am using Sharekit to share the pics.

I am getting below error, can anyone guide me, how can I resolve it?


<?xml version="1.0" encoding="UTF-8"?>

  /oauth/access_token
  Required oauth_verifier parameter not provided

"There was a problem requesting access from Twitter"

many thanks in advance!

Thanks

sheldonrampton · 2013-04-06T16:43:00.000Z

Drupal developers who have been inconvenienced by this (as I was) will want to know that there is a patch for the Twitter module that fixes this latest surprise from Twitter: http://drupal.org/node/1924478

vicconsult · 2013-04-06T19:07:22.000Z

I few days ago my Twitter authorization stopped working.
I’m using twitter4j.
The error was thrown when I was attempting to get access token - getOAuthAccessToken
The solution was to provide the oauth_verifier - getOAuthAccessToken(oauth_verifier)

DynamicTweetApp · 2013-04-06T19:17:00.000Z

My app stopped working the other day too. After spending hours researching I finally stumbled across this thread. Previously I was not passing the [oauth_callback] or the [oauth_verifier]. I’ve added these two elements but I keep getting the Authorize 401 error.

I’ve modified some of the key information below for obvious reasons and I separated each element into its own line for better readability but can someone please help point me in the right direction. What am I missing?

https://api.twitter.com/oauth/access_token?
oauth_callback%3Dhttp%253A%252F%252Fwww.mysite.com%252FGetToken.aspx%26
oauth_consumer_key%3DzCKw6ORW8e3B5xptSF2Q%26
oauth_nonce%3D1D5A4D8A%26
oauth_signature_method%3DHMAC-SHA1%26
oauth_timestamp%3D1365274825%26
oauth_token%3DFqjqCAvAhsQZep0CuUMeoRY8YPDLDVbTskDH7BqZDM%26
oauth_verifier%3D2mBoRD05aWO6A2EimXybQ60dI7UkL4xFt1g2Jqxj4M%26
oauth_version%3D1.0%26
oauth_signature=%2bYxKc1eBPnsAeuMdImwnqsqnpxQ%3d"

DynamicTweetApp · 2013-04-06T20:30:00.000Z

Just an fyi…per the posts above I added both the
oauth_verifier and oauth_callback to my code

However, when I used this combination with the [https://api.twitter.com/oauth/request_token] uri it did not work. I then took out the [oauth_callback] and everything worked again.

For me the solution was to just add the [oauth_verifier].

I’m still pissed that Twitter just makes changes like this and does not announce anything. I’m also nervous that the official post above said we had to add both parameters but in my case when I did this things did not work. So now I guess I get to wait until the other shoe drops and things stop working because I don’t have the [oauth_callback] parameter included.

wittynate · 2013-04-08T17:58:01.000Z

A little heads up would have been nice.

sumitjasuja90 · 2013-04-08T10:01:51.000Z

can you explain that how to pass oauth_verifier ??

317949780 · 2013-04-08T10:15:00.000Z

I don’t hnow how to pass “oauth_verifier” ,can you explain?thank you !