[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Dewald Pretorius
On Aug 24, 2:45 pm, Chris Babcock wrote: > apps need to plan to fail any time a > request goes out over the wire. That's a reality of the programming > environment that isn't specific to OAuth and Twitter. Planning to fail is not the issue. Getting thousands of users to reauthorize your app, whe

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Chris Babcock
On Mon, 24 Aug 2009 22:06:21 +0530 srikanth reddy wrote: > > Sign in with Twitter isn't conceptually compatible with the design > > of OAuth authentication, but it makes an attempt to deliver on what > > the consumer expects from it. > > > i am not sure i get this But from Desktop app point of

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Chris Babcock
On Mon, 24 Aug 2009 09:53:33 -0700 (PDT) Dewald Pretorius wrote: > That gives me absolute nightmares, when I need to do API calls on user > accounts when the user is not logged in to my site. > > I need the OAuth tokens, which will stored in my database, to remain > valid until the user revokes

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread srikanth reddy
Yes. user details are returned along with access tokens/secret. There is really no need to call verify_credentials < > This way of doing things is against the "Sign in with Twitter" > philosophy, but then I also don't see a way of re-using the access > token if you are going with "Sign in with Twi

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Dewald Pretorius
That gives me absolute nightmares, when I need to do API calls on user accounts when the user is not logged in to my site. I need the OAuth tokens, which will stored in my database, to remain valid until the user revokes the access of my app. Meaning, once a user authorizes my app and until he re

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Chris Babcock
On Mon, 24 Aug 2009 20:43:57 +0530 srikanth reddy wrote: > just to add you can obtain the user id , screen name along with access > token/secret . You need to cache this. I stopped development on my own API library and decided to use Python for my app when Twython was introduced, so I haven't

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Chris Babcock
On Mon, 24 Aug 2009 03:04:52 -0700 (PDT) abhishek sanoujam wrote: > You don't need to get permission everytime from the user if you are > going to store it in a DB. The problem with this is that you will have > to implement another level of authorization in your site/app, kind of > a password fo

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread srikanth reddy
just to add you can obtain the user id , screen name along with access token/secret . You need to cache this. On Mon, Aug 24, 2009 at 3:56 PM, Chris Babcock wrote: > > > > I understand that we can store the access token in DB. > > but how do i know the logged in user's screen name after session >

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread srikanth reddy
Currently access tokens do not expire. You get same access token for a user sending request via particular consumer. Limit is per account not ip. On Mon, Aug 24, 2009 at 3:34 PM, abhishek sanoujam wrote: > > You don't need to get permission everytime from the user if you are > going to store it i

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Chris Babcock
On Mon, 24 Aug 2009 05:21:05 -0700 (PDT) "J. Dale" wrote: > I've read the http://apiwiki.twitter.com/Sign-in-with-Twitter FAQ and > they say that access tokens don't expire. However, it appears that > they do. Has anyone else noticed that storing access tokens in the > database doesn't really

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread abhishek sanoujam
You don't need to get permission everytime from the user if you are going to store it in a DB. The problem with this is that you will have to implement another level of authorization in your site/app, kind of a password for your app, so that when the session times out, or a user comes back again,

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread J. Dale
I've read the http://apiwiki.twitter.com/Sign-in-with-Twitter FAQ and they say that access tokens don't expire. However, it appears that they do. Has anyone else noticed that storing access tokens in the database doesn't really work? On Aug 24, 1:11 am, DesignFellow wrote: > Hi, > > I am learn

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Chris Babcock
> I understand that we can store the access token in DB. > but how do i know the logged in user's screen name after session > timeout? Nowhere in the entire OAuth workflow do you handle users' passwords or their usernames. A benefit is that you do not need the Twitter username to perform any fun

[twitter-dev] Re: oAuth doubt : do we need get access permission from user every time

2009-08-24 Thread Abraham Williams
Check out: http://apiwiki.twitter.com/Sign-in-with-Twitter Abraham On Mon, Aug 24, 2009 at 00:11, DesignFellow wrote: > > Hi, > > I am learning Twitter oAuth. I have a doubt of using oAuth. > > do we need to get access permission everytime from the user to get an > access token? > > I understan