Two-factor auth breaks third-party app authorization

jcarty · 2013-05-24T19:28:13.000Z

It seems users who have enabled two-factor verification are having problems logging into not only our apps but other apps, as well.

edodev · 2013-05-24T20:02:07.000Z

Got the same problem. Any pointers to what changes needed in the client auth process?

episod · 2013-05-24T20:09:21.000Z

There’s a special condition you can choose to handle for xAuth in this case – we recently updated the xAuth documentation to reflect this: [node:136]. (note the new “login verification” section).

If you’re using the web-based OAuth flow, login verification is handled as part of that – though there is currently a bug with the usage of the force_login=true parameter that is working toward resolution.

jcarty · 2013-05-25T06:06:56.000Z

@episod - getting “Sorry, that page doesn’t exist” with web-based OAuth flow after logging in but before redirect with login verification enabled. No force_login=true is used.

edodev · 2013-05-26T03:30:03.000Z

@episod Have the same problem as @jcarty, “Sorry, that page doesn’t exist” and dead end. Our users in production start to report login problem, please help!

jcarty · 2013-05-28T22:17:00.000Z

This seems related: https://dev.twitter.com/issues/1050

metarain · 2013-05-31T04:56:07.000Z

Not working here also

episod · 2013-05-31T05:11:44.000Z

The fix for this is taking a little longer than we expected but we’re on top of it.

starho7 · 2013-06-14T08:22:14.000Z

도와주세요.!!

venomben · 2013-07-02T09:35:03.000Z

I too am experiencing issues with the two-factor web-based OAuth login flow on our apps, the redirect to ‘GET /account/login_verification/sms?’ returns HTTP 302 error with /?login_verification_error=BadSessionLoginVerification - any ideas?