Question

My app requires from users to login with their twitter acount! I am using tardate oauth lib (from Paul Gallagher). That works fine. I wanna create an API for my website (actually the user authentication part). Twitter Basic Auth has been deprecated and now twitter uses twitter echo. If a user wants to upload a file via api in my app, he must include in his request the above header. So, my problem is: (i suppose that header hits twitter api directly and twitter returns in my url the response..is this right?)

how my app can handle the twitter response? json that contains user’s info (or a negative response 401), in order to continue the uploading or not. Something like the twitpic API does.(http://dev.twitpic.com/docs/2/upload/) or by similar services.

curl -v -H 'X-Auth-Service-Provider: https://api.twitter.com/1/account/verify_credentials.json' -H 'X-Verify-Credentials-Authorization: OAuth realm="http://api.twitter.com/",
oauth_consumer_key="yTrEIQH6jhtmLUypg8T5", oauth_signature_method="HMAC-SHA1",  
oauth_token="514797-YuI8aYUDRmykzVKrgoLhXSq67TEa5ruc4GJC2rWTyu",oauth_timestamp="1271323750",
oauth_nonce="oYu6nMTQIZvqvlfXM56aBLAf5noGD0AQR3Fmi7U9Y", 
oauth_version="1.0", oauth_signature="CV4bTfE7Rs9J1kafTGwufLJdspo%3D"' -F "file=@/path/to/file" http://localhost:3000/api/upload.xml

my def upload currently works for a simple upload via api. Without a user info. But in this way my app doesn’t know the file owner!

def upload
        file = File.new
        file.file = params[:file]
        # ... extra code
        respond_to do |format|
            if file.save                
                format.xml  { render :xml => file, :status => :created, :location => file }
            else
                format.xml  { render :xml => file.errors, :status => :unprocessable_entity }    
            end
        end
     end

Do you have any idea how can be the coding logic?

Any help will be highly appreciated 🙂

Answer 1

I think that the best way is to grab headers and then use Patron..

auth_headers = request.headers["X-Verify-Credentials-Authorization"]

Patron can make a post request to https://api.twitter.com/1/account/verify_credentials.json and then check the resp status!