Our website lets users create small widgets that can be embedded on other third party sites. When an end-user interacts with our widget on some site, we want to post a twitter update on his/her behalf and then display a message to the user on the widget itself(provided the twitter update was successful). We've been using the twitter api with basic auth to do this(we asked the user for their username and password within the widget itself). Now that twitter has moved to OAuth exclusively, we have created a twitter app to use the OAuth API.
Now, one way to go about this is to register our twitter app as a client app(instead of a browser app). For this, the possible flow is that we ask the user to goto a url(link click and opens in a new window) and then authenticate on twitter,give permission to our app and come back to the widget and enter the pin that twitter provides. this is cumbersome.
The other way is to register the app as a web app. Once the user authenticates and gives perms(in the new window opened as a link click), we ask twitter to redirect to our own custom url with the access token and other info(needed to tweet for the user). So, tweeting should work fine. But, how do I notify the widget(running within an iframe in the original window) whether the tweet was successful or not ?
I can think of a polling based solution, but there has to be a better way, right ?
Also, I cannot use window.open (instead of a link with href = and target = _blank) because browsers treat them as popups and block them.