28

I was wondering how to do twitter OAuth via a popup, i.e. load up the Oauth page in a popup and make the callback close the child window and reload the parent window.

Edit: OK iframes are bad, but how would you accomplish the above, I notice posterous.com does this - I'm looking to achieve the same flow as FB connect.

3 Answers 3

63

Doing the same thing for Yahoo today...

  1. Open a popup
  2. Send user to twitter for authentication
  3. Twitter sends user back to mysite.com/authcompleted.php, with authentication parameters in the query string. Still in the popup here.
  4. The popup (mysite.com/authcompleted.html) reads the query string and sends the data to the opener window via javascript

    window.opener.setTwitterAuthData(yourData)

  5. Inside setTwitterAuthData, which is in your main window, set appropriate form fields and submit the data to your server.

5
  • how can you still be in the popup, point 3., when the callback is mysite.com/authcompleted.php?
    – Owen
    Commented Sep 15, 2010 at 8:47
  • 1
    @mark You point the popup to yahoo to begin with, then yahoo redirects, still inside the popup, to authcompleted.php Commented Sep 15, 2010 at 18:31
  • How do you detect when the redirect had happened and there is a response? Commented Aug 17, 2015 at 22:29
  • Yes, i use the same flow, but what about mobile devices?? Its it correct flow for it?
    – Grey2k
    Commented Nov 7, 2015 at 12:47
  • now working if you write incorrect password and redirect happen. window.opener not defined Commented Nov 25, 2020 at 8:26
6

You shouldn't do this. Loading it in an IFrame hides the URL from the user, making it difficult for them to confirm that they're entering their password on twitter.com and not a third-party (i.e. phishing) site.

4
  • 2
    I agree in principle, but doesn't the auth page only have allow || deny this application buttons - it doesn't ask you for your password. So I can't see why it should be a problem from a security perspective, while helping the UX flow. Commented Dec 10, 2009 at 4:18
  • 4
    If you're not logged in it asks you for your password. Commented Dec 10, 2009 at 13:48
  • 3
    There is iframe busting JS on the non-logged in page where it asks you for your password (line 37) Commented Dec 10, 2009 at 14:23
  • 2
    Twitter's OAuth page now uses the X-Frame-Options header to prevent loading it in an iframe :) Commented Dec 29, 2014 at 22:57
6

This maybe helpful!

http://zuzara.com/blog/2010/05/15/jquery-plugin-for-twitter-oauth-via-popup-window-facebook-style/

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.