Twitter OAUTH与PHP的流程

Question

I am using twitteroauth.com's library and everything is successful but since I am new to having users log into my website using their Twitter credentials I am having a disconnect on how the user logs back into my website later.

I generate a request token and convert that successfully to an access token. I store the array that is returned:

Array ( [oauth_token] => 12341234-ASDFASDFASDFASFASDFASFASDFASFD [oauth_token_secret] => ASDASDFASDFASDFASDFASDFASDFASDF [user_id] => 12341234 [screen_name] => johndoe [x_auth_expires] => 0 )

now that I have this info I store it in my database associated with the user's existing (or newly created) account to my website.

however, what calls do I make to Twitter using the TwitterOauth api later when the user comes back to my site?

do I generate a new request token and convert it into a NEW access token every time the user comes to my site?

thanks!

Answer 1

Found answer to my own question. In case anyone else would like clarification.

From: https://dev.twitter.com/web/sign-in/implementing

The sign in endpoint will behave in one of three ways depending on the user's status:

Signed in and approved: If the user is signed in on twitter.com and has already approved the calling application, they will be immediately authenticated and returned to the callback URL with a valid OAuth request token. The redirect to twitter.com is not obvious to the user.

Signed in but not approved: If the user is signed in to twitter.com but has not approved the calling application, a request to share access with the calling application will be shown. After accepting the authorization request, the user will be redirected to the callback URL with a valid OAuth request token.

Not signed in: If the user is not signed in on twitter.com, they will be prompted to enter their credentials and grant access for the application to access their information on the same screen. Once signed in, the user will be returned to the callback URL with a valid OAuth request token. The possible states for the sign in interaction are illustrated in the following flowchart:

Upon a successful authentication, your callback_url would receive a request containing the oauth_token and oauth_verifier parameters. Your application should verify that the token matches the request token received in step 1.