I have an PHP SDK for Twitter OAuth, but in it's constructor, I have to pass the OAuth secret and token, which I don't have. Usually I won't need this, because I am getting them by request (GET), but I need a set, to be able to test my script.
So, is there any (edit: easy) way I can get them? Maybe an online generator for it or something else?
You can get these details at https://dev.twitter.com/apps
Sign in and select your application, then somewere in your app settings they provide you with Oauth details for your own app.
You have to create an application by following url https://dev.twitter.com/apps/new
You can use it for your tests.
Related
I am looking for some simple creation of Token to authenticate for each Rest Api call.
Actually I am new to this authentication process, I gone through some websites and forums but I didn't get proper idea on where to store the token after login and how to use it for authentication.
Please provide me with an example code?
Note: I was creating Rest Api for my website only, so no need of other keys are required to create access token I think so.
Some oAuth2 examples for using with Phalcon:
https://github.com/sergeyklay/awesome-phalcon#authentication--oauth
RESTful examples:
https://github.com/sergeyklay/awesome-phalcon#restful
I am here with some general discussion very famous and interesting topic "Token Based Authentication".
I need my registered users to login with API. Scenario is quite simple, We want to pass our login details to Server. Server will check the credentials with database. If credentials are proper then Server will create "Session Id" and return back to user (client end). In subsequent requests user just need to pass that "Session Id" to authenticate and access protected data.
Plenty of people suggest about OAuth 2.0 and also some people suggest about Custom Logic. In custom logic they asked to be very sure about security. I read documentation of OAuth and it's good and descriptive. I'm also liking it to use. But wherever I search for OAuth authentication, they are giving example of third party login.
I had installed Php OAuth extension at my side for supporting this feature. In examples they asked to create Request Token first using "getRequestToken" function. Using that Request token they asked to call "getAccessToken" function to get "Access Token". Using that Access Token just need to call "fetch" to get protected data.
Now my questions are,
In my scenario, Do i need Request Token? Is that possible to get Access Token directly
What is OAuth Consumer Key and OAuth Consumer Secret key? Do I need such keys in my application? I believe it's used to allow third party applications only. In my case I'm the resource owner and i'm the consumer.
Do you guys have any example for me to study?
Do you know any well known framework for OAuth for PHP?
Is that need any additional database support except "user" table? For storing OAuth details?
Any additional documents to study for this would be highly appreciated.
I read different Grant Types in OAuth but confused how to use to achieve my approach.
Thanks in advance.
From what I read, you do not need OAuth at all. OAuth is need if there is a third party involved that needs access to your user resources.
As you mentioned, you just need a Login API something like https://myserver.com/signin?user=john.doe#gmail.com&password=12345
After successful login, the server generates a GUID and stores it against the user. You can call it sessionId/cookieId anything you like. Response could be something like '{user:john.doe#gmail.com; sessionId=KJN93EJMQ3WEC9E8RCQJRE8F9E}'
For subsequent calls, the sessionId can be passed in the header.
Server validates the session and lets the user in.
Addtional considerations:
I am assuming your server is HTTPS and hence the user/pwd on the URL are encrypted.
For security you might want to invalidate the sessionId have the sessionId renewed periodically.
Have a logout on which you clear the sessionId against the User.
I think it standard stuff if not the logging in happening via REST.
The requirement that I posted before to login with OAuth2.0.
Usually people assume that OAuth2.0 is only for fetching data by Third Party application from resource center behalf of Resource Owner. That approach is called Authorization Code.
OAuth2.0 has various "Authorization Grant". There are four types,
Authrozation Code
Implicit
Resource Owner Credentials (User Credentials)
Client Credentials
After research, I realize that "Resource Owner Credentials" is best suitable for me. I found one perfect library that helps you to understand background process internally. Here's the GitHub link to download.
Found two major issues here,
When I use my Access Token created by my Mozila in Chrome. Surprisingly, It's allowing me to access my private data from other browser.
I'm unsure but will this approach work same with AJAX type of calls (jQuery tool)
If anyone has idea then please share.
Thanks,
Sanjay
I'm currently building a web application which is an AngularJS frontend that communicates with a RESTful API built using Laravel. I'm making good progress, but finding it hard to get my head around how to handle user authentication.
I've been advised that I should be using OAuth for authentication, and I've decided to use it seen as it could be a learning experience for me as well. The package I'm using to handle this is oauth2-server-laravel.
The basic user story is that users can register their username/password combination for the application, and they then log into the application with that same username and password. They're only authenticated by their username and password, and not by any client secret. After login, they should be given an access token which will be send along with every future request to authenticate them on different API endpoints.
The OAuth2 library has a "password flow" grant type which seems to be what I need, however it also takes client_id and client_secret parameters, which I don't want. The request URI is something like this:
POST https://www.example.com/oauth/access_token?
grant_type=password&
client_id=the_client_id&
client_secret=the_client_secret&
username=the_username&
password=the_password&
scope=scope1,scope2&
state=123456789
But what I want is just:
POST https://www.example.com/oauth/access_token?
grant_type=password&
username=the_username&
password=the_password
How am I meant to provide a client ID and secret of a user that has yet to authenticate?
Is there a different grant I can be using, or is what I want to achieve just not suited for OAuth at all?
Take into account, that client id and client secret aren't parameters that you have to force your end-user to pass. They are static and defined in/for your client app (angular app in this case).
All you need to do is to create a record for your main app in oauth_clients table, and create a scope with full access in oauth_scopes table, and send this values when requesting token.
And that's all in fact.
Also, you may want to consider using implicit grant flow in case of building js-only application, because storing client secret and refresh token in a js app is insecure. Using implicit grant in a final product may look like login window on soundcloud and is more secure as the token is obtained server-side without exposing client secret.
Another way to go, if you still want to use password flow is creating a proxy for refreshing tokens. Proxy can hide your refresh token in encrypted http-only cookie, and your js-app don't ask your api for new token, but the proxy instead. Proxy reads refresh token from encrypted cookie, asks the api for new token and returns it. So the refresh token is never exposed. If you set token ttl for an hour let's say, then stealing a token would be quite "pointless*" in case of a normal application, and stealing refresh token would be "impossible*".
*Of course if someone really want he probably could hack it any way.
And yeah, i know this all looks a bit hacky - modal windows for logging in, proxy etc. But also searching on this topic i couldn't find any better and more elegant way of doing it. I think that's still a lack that all js-apps have to deal with if you want a token based authentication.
You are missing something with the OAuth specification. The client_id and client_secret are really important when asking for an access token when using the password method of OAuth v2. In fact, they are important for every method that gives you an access token. They identify the application or the server that has perform the request.
For example, let's say you have your API, 2 mobile applications and another server that do some tasks with your API. You will create 3 clients with their own client_id and client_secret. If your application has various access levels (they are called scopes in OAuth v2), the client_id corresponding to the other server will be able to call functions of your API that require the scope admin whereas your mobile application will only be able to call functions of your API that require the basic scope if you have defined scopes like this.
If your API grows up in the future, this is really essential. Another example, let's imagine you have given an API key (a pair client_id and client_secret) to one of your friend and he has build a nice mobile app with your API. If one day he starts doing naughty things with your API, you can't stop him very easily. Whereas you could have just removed his key pair if you had followed OAuth v2 principles.
OAuth v2 is not an easy thing to understand, take the time to read specifications and good tutorials before developing your API.
Some useful links :
The official RFC : https://www.rfc-editor.org/rfc/rfc6749
A tutorial on Tutsplus : http://code.tutsplus.com/articles/oauth-20-the-good-the-bad-the-ugly--net-33216
Just to add a bit to plunntic's excellent answer: remember "client" is not related to "user", so when I use a password flow I just define the client_id and client_secret as constants on the AngularJS app to tell the api backend: hey, this is the browser app that is being used to request a token.
Im currently creating a PHP application that searched various Social Media and analyses the results. Now im stuck at calling the LinkedIn API.
I need to call these API's without user authentication (I need a sort of app authentication). Facebook offers a way to retrieve an access token, based on app key and secret. With Twitter I simply used my own accestoken en access secret.
I searched all day for a way to call the LinkedIn API in a similar way, but havent succeeded in finding one. I also couldn't find my own access token en secret on the LinkedIn developer's site.
Do you know how I can access the LinkedIn API from my PHP application, without the user having to login himself?
Hope you guys can help me out!
The LinkedIn API doesn't support non-user-authenticated requests - that is, there are no calls for which you can just use the consumer key and secret - they all require a user token and secret as well.
The LinkedIn API is designed to be used from the member's perspective, acting on behalf of a specific member - it's not designed to support general application search use cases.
Terms of use: https://developer.linkedin.com/documents/linkedin-apis-terms-use
Like Twitter, you could use your own access token, but per the LinkedIn guidelines, you can't show anyone the information that you pull unless you use a token obtained on their behalf.
I am trying to write an php twitter script which will be run by crontab, what the script does is to get the tweets from a dedicated twitter account.
I have looked at some of the php twitter oauth libraries, all of them seem to use redirect to a twitter page to get a token, then goes back to a callback link. In my case I don't want to have any user interaction at all.
Could anyone please tell me what I should do?
Regards
James
Twitter provides a single access token feature on dev.twitter.com designed just for this use.
http://dev.twitter.com/pages/oauth_single_token
You shouldn't need to be using the Twitter API at all. Tweets are public resources, accessible via HTTP.
Here's the official Twitter account's last 10 tweets, available as JSON or XML.
I use oAuth for my Twitter bot. I got the oAuth token by making a web interface and signing it up. I then pass the token with my calls.
I use Abraham's oAuth library:
http://twitteroauth.labs.poseurtech.com/connect.php
You can use the example from the library to get the token. Just have it echo the token from the $_SESSION it creates on the callback.
Unless the account is private, you don't need to be authenticated.
Or use OAuth, and authenticate using an admin screen.
We do not currently expire access
tokens. You access token will be
invalid if a user explicitly rejects
your application from their settings
or if a Twitter admin suspends your
application. If your application is
suspended there will be a note on your
application page saying that it has
been suspended.
http://apiwiki.twitter.com/OAuth-FAQ