How to keep OAuth settings a secret? - php

Question

After creating my Twitter application, the following warning was displayed:
OAuth settings
Your application's OAuth settings. Keep the "Consumer secret" a
secret. This key should never be human-readable in your application.
How do I keep my "Consumer Secret" a secret?
Twitter_test.php (source: Jimbo)
// Set access tokens here
$settings = array(
'oauth_access_token' => "My Oauth Access Token",
'oauth_access_token_secret' => "My Oauth Access Token Secret",
'consumer_key' => "My Consumer Key",
'consumer_secret' => "My Consumer Secret"
);
$url = 'https://api.twitter.com/1.1/followers/ids.json';
$getfield = '?username=somename';
$requestMethod = 'GET';
$twitter = new TwitterAPIExchange($settings);
echo $twitter->setGetfield($getfield)
->buildOauth($url, $requestMethod)
->performRequest();
?>
TwitterAPIExchange (source: twitter-api-php)

Answer 1

I'd create a library integrated with the Twitter Api, and store the data in a config file in application/config/ as mentioned in given link.
To please Twitter, simply parse:
$this->load->library('encrypt');
echo $this->encrypt->encode('your given secret here');
Take the output, store it inside the config file, and when you're fetching it:
$this->load->library('encrypt');
$str_secret = $this->encrypt->decode($config['secret']);
Encryption
-Don't forget to set a key as described in this link.
Note that they demand you to do that for maximum security, in case someone would get control over your ftp or similiar. However if it can be decoded, it can be read. This isn't the ultimate solution, but simply a bit more reliable one.

Answer 2

You can save Consumer secret in database in serialize format and than unserialize while fetching and than use it.

Answer 3

consumer_secret is a secret key given by twitter when you sign up for the apis. You can keep it safe by putting twitter code in your library or any as such folder and make sure that folder is not directly accessible using browser url.
For example if you put twitter config.php in lib folder then it should not be accessible like this
www.somedomain.com/lib/config.php