Question About Callback Protocol and Query Params

[paulkist]

Had a couple questions about the upcoming June 12th changes to Oauth and Callbacks.
For the purposes / context of this question, my Twitter App is currently configured with Callback Locking turned on

1. Protocols: Currently I have my callback set up in the following format in the whitelist:

http://myapp.com/callback/twitter?user_id=

This seems to work fine. Even when we send the callback_url param as https://myapp.com/callback/twitter/user_id=3 or https://myapp3.com/callback/twitter/user_id=5

However when I change the protocol in my whitelist to https, the whole thing breaks and OAuth does not occur successfully. Why is this happening?

2. Dynamic Query Params: As in my above example, I’ve specified a user_id param however it can be any value. Again, I have callback locking turned on, and when I have my whitelist set up as defined above, I have no issues. Is this going to remain the case on June 12th?

Any advice / direction here would be helpful.

[paulkist]

Bumping this up, as we’re approaching June 12th, getting clarity on this for our group and others, would be really helpful. Thank you!

[paulkist]

I realize this wasn’t tagged correctly. I’ve updated it with the OAuth tag.

Again, the app works fine as-is, with callback-locking turned on, but the behavior doesn’t make sense, and would like to validate our approach is correct so we’re not surprised by anything come June 12th, thank you.

[paulkist]

@andypiper as you have been answering many questions on this topic, I was wondering if you’d be able to take a look at this question above.

It’s unclear to me, at the moment, whether we are OK as-is or if changes are needed in our code or to the Twitter App settings.

Much appreciated, thanks!

[andypiper]

I’ve heard from other developers that adding parameters should indeed pass through on the callbacks. The thing I’m not sure on here is why HTTPS would break for you. Is your app able to support TLS connections?

[paulkist]

@andypiper, thanks for getting back to me on this!

1. Regarding the callbacks and params, that’s great news, and looks like we’re going to be ok there
2. Regarding HTTPS breaking, I’ve tracked down the issue to something on our side.

This clarifies things. What we needed to really make sure of was if passing over params were OK, and it sounds like they are. Is that something to be added to the docs for future devs / oauth clients? I know different platforms have different rules regarding passing params in the callback URL, so it’s great to know your stance on that.

Thanks again

[andypiper]

To clarify this is my understand rather than this being our stance. I’ve heard from at least two others that it works and yes we should improve the docs. Setting Callback locking now should have the exact same effect as the behaviour from next week onwards, there’s no hidden extra change being applied on that date!

[paulkist]

@andypiper this is very good news indeed. Thank you

[andypiper]