Twitter身份验证/ PHP Oauth：要求用户每次尝试进行身份验证时都要对应用程序进行实时操作

Question

The code itself is pretty basic. I am trying to allow user to connect to Twitter and later to use Twitter as a mean of authentication (afaik, this is called OpenId). However, the problem is that every time when user executes the code he is asked to reallow the application – instead I expect it to return some sort of variable indicating that user is already connected to the app.

$oauth          = new OAuth(TWITTER_CONSUMER_KEY, TWITTER_CONSUMER_SECRET);
$callback_url   = 'http://guubo.com/connect/1';

try
{
    if(empty($_GET['oauth_token']))
    {
        unset($_SESSION['hp']['twitter']);
    }

    if(empty($_SESSION['hp']['twitter']['oauth_token_secret']))
    {
        $access_token   = $oauth->getRequestToken('https://api.twitter.com/oauth/request_token', $callback_url);

        //die(var_dump( $access_token ));

        $_SESSION['hp']['twitter']['oauth_token_secret']    = $access_token['oauth_token_secret'];

        header('Location: https://api.twitter.com/oauth/authorize?oauth_token=' . $access_token['oauth_token']);

        exit;
    }
    elseif(!empty($_GET['oauth_token']))
    {
        $oauth->setToken($_GET['oauth_token'], $_SESSION['hp']['twitter']['oauth_token_secret']);

        unset($_SESSION['hp']['twitter']);

        $access_token_info  = $oauth->getAccessToken('https://api.twitter.com/oauth/access_token');

        $db->exec("INSERT INTO `user_tokens` (`user_id`, `network_id`, `oauth_token`, `oauth_token_secret`) VALUES ({$db->quote($user['id'])}, {$db->quote($network['id'])}, {$db->quote($access_token_info['oauth_token'])}, {$db->quote($access_token_info['oauth_token_secret'])})");

        $response_array = array();

        parse_str($oauth->getLastResponse(), $last_response);

        #die(var_dump( $last_response[''] ));
    }
}
catch(OAuthException $e)
{
    echo $e->getMessage();

    exit;
}

Answer 1

Take a look at this document regarding the "Sign in with Twitter" flow, which it looks like you are trying to implement. The one thing I notice in your code is that you are calling oauth/authorize where you should be calling oauth/authenticate. Here's a relevant excerpt:

The normal [OAuth] flow dictates that applications send request tokens to oauth/authorize in Twitter's implementation of the OAuth Specification. To take advantage of "Sign in with Twitter", applications should send request tokens received in the oauth_token parameter to oauth/authenticate instead.