Question

I’m programing an Twitter/Facebook app for iPhone.
I have my own Apache/PHP server.
I want to only place the Consumer Key in the app, then I place the Consumer Secret in my own server, so the Consumer Secret is in secret.
After surveying several demo apps (on the Google). I see that it’s easy with Facebook (only provide AppId, not provide AppSecret). But with Twitter’s OAth libs, I must provide both Consumer Key and Consumer Secret.
Is there anyway to solve it? Any library solved it?

Answer 1

I found the solution for myself: Consider the app as an web app, not an mobile app, consists of 3 parts: Facebook/Twitter server, my own app (Apache/PHP) server and browser (the web view on mobile device). With this architecture: my own app server is responsible for authentication and other tasks (post to wall), it store appId, app Secret and userToken, all information, it connect to Facebook/Twitter server directly; the mobile device has role only as an browser agent, it only display a web view pointing to the link that my own server supply, it doesn’t store any information

Consider these two documents of Facebook and Twitter about authentication for web app for more detail:

http://developers.facebook.com/docs/guides/web/#login view Authentication section

https://dev.twitter.com/docs/auth/oauth