I'm confused about the OAuth docs linked to from http://apiwiki.twitter.com/
-- especially these:

http://apiwiki.twitter.com/Twitter-REST-API-Method%3A-oauth-request_token
http://apiwiki.twitter.com/Twitter-REST-API-Method%3A-oauth-access_token

Both of these link to the OAuth 1.0 spec for a list of required
parameters.  Shouldn't they link to the 1.0a spec instead?

I came to the docs remembering the news story from last April about
OAuth and session fixation vulnerabilities:

http://oauth.net/advisories/2009-1/
http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-attack/
http://www.readwriteweb.com/archives/how_the_oauth_security_battle_was_won_open_web_sty.php

And how it affected Twitter:

http://blog.twitter.com/2009/04/whats-deal-with-oauth.html
http://news.cnet.com/8301-13577_3-10225103-36.html

But if you look at the API docs today, it's like none of this
happened.  I can't find 1.0a documented anywhere, and all but one of
the code examples the docs link to continue to use the 1.0 token flow
(only http://github.com/moomerman/twitter_oauth appears to get it
right of the ones I checked -- http://github.com/henriklied/django-twitter-oauth
and http://github.com/tav/tweetapp don't, for instance).
http://apiwiki.twitter.com/OAuth+Example+-+Ruby isn't publicly
visible.  Session fixation isn't mentioned on the "Security Best
Practices" page (http://apiwiki.twitter.com/Security-Best-Practices).
1.0 vs 1.0a isn't in the OAuth FAQ (http://apiwiki.twitter.com/OAuth-
FAQ) or the main FAQ.

(I do see 
http://groups.google.com/group/twitter-development-talk/browse_thread/thread/472500cfe9e7cdb9
and of course all the discussion of OAuth and the PIN problems for
mobile apps.)

Shouldn't the documentation point people towards the current spec, and
show examples that implement it?  Or is there some reason people are
being pointed to 1.0?

I'm asking because Tornado (http://www.tornadoweb.org/) provides a
Twitter OAuth mixin in its auth module (http://github.com/facebook/
tornado/blob/master/tornado/auth.py) which uses the 1.0 token flow (as
do all of the OAuth mixins in Tornado).  Google OAuth implements 1.0a,
and shows the user a security warning if the 1.0 flow is used, but
Tornado makes this hard to implement using their auth module.  I'm
working on a patch to send them and want to know whether the Twitter
OAuth mixin should be upgraded for 1.0a or if there's some reason it
shouldn't.

Thanks.  (I'll stay on this list long enough to hear the discussion
but will probably bail out after that, since it's a high-volume list
and my interest is just in making the patch right.)

-Marc

Reply via email to