Create OAuth Flow for Twitter and Facebook with spring social

Question

I need to transport certain data from one request to another for the oauth workflow.

@RequestMapping(value = "/connect/twitter", method = RequestMethod.POST)
public RedirectView connectTwitter(HttpServletRequest request,
                                   Model model) {

    TwitterConnectionFactory connectionFactory = new TwitterConnectionFactory(
            environment.getProperty("spring.social.twitter.app-id"),
            environment.getProperty("spring.social.twitter.app-secret"));

    OAuth1Operations oauthOperations = connectionFactory.getOAuthOperations();
    OAuthToken requestToken = oauthOperations.fetchRequestToken(request.getRequestURL().toString(), null);
    String authorizeUrl = oauthOperations.buildAuthorizeUrl(requestToken.getValue(), OAuth1Parameters.NONE);

    //need requestToken in the next process

    return new RedirectView(authorizeUrl);
}

@RequestMapping(value = "/connect/twitter", method = RequestMethod.GET)
@ResponseBody
public String verifyTwitter(@RequestParam("oauth_token") String oauthToken,
                            @RequestParam("oauth_verifier") String oauthVerifier,
                            OAuthToken requestToken /*need requestToken from last request*/) {

    TwitterConnectionFactory connectionFactory = new TwitterConnectionFactory(
            environment.getProperty("spring.social.twitter.app-id"),
            environment.getProperty("spring.social.twitter.app-secret"));

    OAuth1Operations oauthOperations = connectionFactory.getOAuthOperations();
    OAuthToken accessToken = oauthOperations.exchangeForAccessToken(new AuthorizedRequestToken(requestToken, oauthVerifier), null);
    Connection<Twitter> twitterConnection = connectionFactory.createConnection(accessToken);

    return "asd";
}

the requestToken from the frist request has to be available in the next request. how to handle it?

Answer 1

Well, one way to do it is to store it in "session". I say put quotes around that because I don't necessarily mean servlet session (which may or may not work across multiple nodes, depending on your server setup). It could be anything that performs the function of session, such as (perhaps) a Redis key-value store. Of course, once you fetch it from "session", you'll also want to clean it out.

Spring MVC supports flash attributes directly for this purpose. See http://docs.spring.io/spring/docs/4.0.6.RELEASE/spring-framework-reference/htmlsingle/#mvc-flash-attributes .

Also, it strikes me that you're writing your own controller to do the OAuth dance with Twitter, but Spring Social's ConnectController already exists for that purpose. See https://github.com/spring-projects/spring-social-samples/tree/master/spring-social-showcase for an example of how ConnectController is used.