Secure OAuth Twitter authentication in JavaScript / jQuery (plus a server-side secondary server)

Question

What is the best safe way to use Twitter OAuth authentication in JavaScript?

I am trying to write a program so that the user can analyze his use of Twitter and followers / friends. I wrote a server side version that works using the tweepy python module.

I would like to share it with people, but I would like it to work in a browser in order to be scalable and works on my small server.

I see another question why the result is not recommended and unsafe: JavaScript OAuth logs in with Twitter

Which makes sense if you send the secret secret of a user or user (application) to a JavaScript application.

But why can't I create a server side url like here, http://djangosnippets.org/snippets/1353/

Then send the authentication URL back to the browser, something like this on the OAuth Tool page on the Twitter My Applications page (invalid credentials)

GET & HTTPS% 3A% 2F% 2Fapi.twitter.com% 2F1% 2F & get% 252Faccount% 252Fverify_credentials_json% 3D% 26oauth_consumer_key% GD0bgcgMU4MDwNfKQpLFQS3% 26oauth_nonce% 3D24ad5049501dee1292afd8cf22307d68% 26oauth_signature_method% 3DHMAC-SHA1% 26oauth_timestamp% 3D1329173626% 26oauth_token% uPUpxsBc3D283768289LtQ6R1Ez1KeD8DOSsm5XpqJaKI28ysYh% 26oauth_version% 3D1.0

Then use jQuery to authenticate with the user credentials and run the analysis.

This is a significant part of the work, I would not want to do this, and then I found out that it does not work or is unsafe. (or it's already done)

It is safe? He does not seem to reveal any secrets.

Will this work?

Any pointers / examples on the right authentication path for jQuery noob, with the necessary Authorization: header and cookie / redirect processing?

I feel that I have something missing, and there is a reason that it will not work, or it should already exist somewhere, but did not find it. Many thanks!

Answer 1

Mr. McNuts's problem is that oAuth requires you to pass on the secret of your consumer, so even if you create a URL on the server, you will still return it to a web page that will still expose your consumer to a secret through an HTTP proxy.

To prevent the disclosure of secrecy, you need to use a proxy server to execute the twitter request and return the Oauth token back to the browser. If you are really worried about scale, I would look at a scale payment solution like GAE or Heroku.

Answer 2

I do not understand very well the approach you are proposing. But in general terms, OAuth cannot be safely implemented on the browser side (other than secure, close environments such as Java or Flash). Implementing the OAuth process in Javascript is possible, but you will open your secret / consumer token. In this way, anyone can supplant your application with mischievous intent, such as stealing your users' confidential data. If you still want to work with JS, I recommend that you implement a secure process (authentication and final token storage) on the server side using Node.js