5

I am using Scribe (OAuth1.0) as a mechanism so that users can use their Twitter account to authenticate to my GWT/GAE application.

According https://dev.twitter.com/docs/auth/implementing-sign-twitter, there are 3 possible scenarios: a/ User is Signed in and approved. In this case, Twitter should redirect the user transparantly back to my application url, b/ user is Signed in but not authorize, or c/ user is Not signed in

When Twitter comes back to my application (the callback), I use the verifier parameter to read the user data from twitter, which I use to determine the user in my application.

All of this works fine except for the following:

Scenario a/ is not working for me. Eventhough the user has already authorized my application to read his user data, Twitter seems not to remember this, and asks again to authorize access. (scenario b/).

  • I may have a solution: I could use the callback parameters to build the access token and store this in a cookie. I think the access token is permanent. When afterwards, the user tries to sign-in using Twitter, the application will use the access token from the cookie. – peternees Jan 15 '13 at 14:50
9

There are two URLs twitter offers for applications requesting an OAuth token: /oauth/authenticate and /oauth/authorize. When an application directs users to the authorize endpoint - Twitter will request the user to authorize the application EVERY time they log-in. The authenticate endpoint will request authorization once and then any subsequent log-ins to Twitter will seamlessly pass-through to the application callback. This is more traditionally known as "signing in with your Twitter account".

In Scribe, the default is authorize - to change this to authenticate you need 2 things:

  1. Ensure the Allow this application to be used to Sign in with Twitter setting is checked in your Twitter application settings page.
  2. In your application - when you specify the Scribe API class to use - instead of using org.scribe.builder.api.TwitterApi.class change this to org.scribe.builder.api.TwitterApi.Authenticate.class

Now your application will direct users to sign-in to the /oauth/authenticate endpoint and, if they have authorized your application at least once, they will just get passed through.

Edit: Additional documentation - https://dev.twitter.com/docs/api/1.1#102

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.