Twitter Authentication Questions

Question

I have two questions (does that violate etiquette?) surrounding Twitter authentication.

The first question is this. I'd like to store the access token that I receive but it is a dictionary object. Do I store the whole dictionary object or just some of the pertinent parts.

Secondly I'd like to know how to log the user out. I found this link that would help log a user out of Facebook - is there anything similar to this for Twitter (or is this logout method a bad idea) http://m.facebook.com/logout.php?confirm=1&next=

Answer 1

You need the access token key and secret to be able to access the API. It doesn't really matter how you store it as long as you store it somehow. The application you are giving access will have a way of storing the data. Unless you are creating a new OAuth application or adding support to an existing application. In which case you will want to store the key and secret using whatever key/value system that is idiomatic (the right way) for that language (i.e. pickling, or config file for python).

The consumer (application) that is given the key and secret will have access to twitter on the user's behalf.

To revoke a particular access key, you login to twitter as the user and go to http://twitter.com/settings/connections. Each application that has a valid access token is listed on that page and can be revoked. Consumers are not really ever logged in like users are, they authenticate using the access key and secret.

Answer 2

What you need to understand is that the OAuth protocol does not define "login" and "logout" concepts, those are inherent to your application. OAuth is a protocol to allow a consumer (your application) to access a resource owner's (one of your users) data stored by a resource provider (in this case, Twitter).

Do I store the whole dictionary object or just some of the pertinent parts.

As far as I know, you only need to store the access token to be able to continue making inquiries to the server for the resources you requested (requesting new resources might require getting another access token). Keep in mind that this token may expire, and may be revoked at any time by the user directly through Twitter, and without your knowledge. This is by design in OAuth.

I'd like to know how to log the user out

There is no "session" in OAuth, that is a concept relevant to your application.