Best practices - store Twitter credentials or not?

Question

I want my users to be able to show their latest tweets on their profile on my website.

I have a twitter shell for PHP and understand how to make API calls, etc., but I'm just wondering how to manage user information.

What is the best practice here? . I want them to be able to enter their credentials once, but I would suggest that storing the entire username / password alone is not the best way to do this.

• Is there a way to make an authenticated call once and twitter will remember it?
• Should I store usernames / passwords and then just make a call when displaying tweets?

Any advice here would be great.

Thanks,

Answer 1

Use OAuth, no need to ask users for their passwords:

http://apiwiki.twitter.com/Authentication

I think everyone could / should probably agree that storing twitter username / passwords is bad, I can't believe that they ever created the situation you needed.

Answer 2

You should never store unencrypted credentials of any type. If your solution involves using a plain text password, even for a short time you need to redo something.

, - cookie OAuth . cookie , .

( ) , Twitter , .

Answer 3

, , , http://twitter.com/statuses/user_timeline/ username.rss

Twitter OAUTH ( ). , ,

Answer 4

, -, , .

If you needed to authenticate somewhere (possibly allowing users to send new tweets) on behalf of the user, it is best practice to invite the user at the time of the initial authentication, and then save any authentication token returned by the resource than the credentials used to obtain it.