Question

I’m writing an extension for Opera and it will use the Twitter OAuth API. I know it is frowned upon, but I’m implementing the Twitter OAuth with Javascript inside the extension. Please bear with me, because I’m not any pro with OAuth.

But here’s what I want to do. Once the user is authenticated with Twitter, I will store the access token in localStorage with the widget.preferences object available to Opera extensions. Here’s the part I’m unsure about right now. In the extension, one will be able to post a comment. The comment will be posted from the extension to a script on a server which will process and insert the comment into a table in a database.

The thing that I want to know about now is, how can I be sure the username of the person posting the comment is the real username of the user that posted the comment and logged in with Twitter in my extension?

If I just sent the username from the extension, it would be extremely easy to just manipulate the username in the request, resulting in a fake username being inserted into the database with the comment.

I could send the access token of the user posting the comment from the extension, the server would receive it with the comment data. Before inserting the comment into the database, could I use the access token sent from the Javascript extension to retrieve with PHP the Twitter username of the user represented by that access token? Or is the access token randomly created each time a user is authenticated so it can’t be reused like this?

Answer 1

OAuth Echo is the standard way to verify Twitter identities through APIs.

The basic flow will be:

1. Extension signs an accounts/verify_credentials request but does not asend it to Twitter.
2. The extension sends the signed request to the server.
3. The server makes the request to Twitter. If it succeeds and returns the screen_name you know who it is.