CODEWITHSUNDEEP
windows-phone-7twitteroauth
Peter Baer
Peter Baer

Reputation: 1292

How do I implement OAuth 1.0 in a Windows Phone 7 app without asking the user for their password?

I am building a WP7 Twitter client. The normal OAuth 1.0 flow involves obtaining a request token by navigating a web browser to https://api.twitter.com/1/oauth/authenticate with my app's consumer key; this page will show a login prompt and ask the user to authorize my app to perform actions on their behalf. Upon completion, this page will redirect to a callback URL supplied by my app, with the request token supplied as a parameter.

For web apps this makes sense. I don't understand how this is supposed to work for a standalone mobile/desktop app, though. The Twitter API documentation seems to imply that this should be a feasible option. They do offer an alternative xAuth mechanism that allows an app to gather username/password itself and then supply that directly to obtain an access token. The API documentation points out that this is an inferior option (as it requires the user to trust the app, not just Twitter, with their password), but I don't see how I have any reasonable alternative?

(there is also a PIN-based option, but that's a pretty burdensome solution for the user)

I just want to make sure I'm not missing anything obvious.

Upvotes: 1

Views: 409

Answers (2)

Kevin Gosse
Kevin Gosse

Reputation: 39007

"For web apps this makes sense. I don't understand how this is supposed to work for a standalone mobile/desktop app, though."

Just embed a web browser control in your app, and navigate to the twitter authentication page. Then detect the redirection to the callback url (using the Navigating event) and retrieve the parameter. Many twitter apps do that, it's basically the same as asking the user for the login and password, except that instead of your own controls you're displaying twitter's page.

Upvotes: 6

MrMDavidson
MrMDavidson

Reputation: 2735

Nope, you're correct. The option for a mobile/desktop application is either a pin-based option or to use xAuth. Once you have an xAuth application has an access token it is indistinguishable from OAuth (it only changes the authorisation workflow). One thing it does change, and this is very specific to Twitter, is that if you do use xAuth then your application will not be allowed to read or write Direct Messages. See Twitter's The Application Permission Model page for more information.

Upvotes: 1

Related Questions