Hi, all
It's been a long time since my last post, but besides being a little bit busy, I also took a vacation, enjoying a trip to US, to visit some old friends. Great trip, by the way. But now, let's get back to work!
One thing that kept me busy during this time was the implementation of Twitter API ME 1.8. This new version is very special, because it comes with full support to OAuth. Since Twitter changed its Application Permission Model, requiring apps to use OAuth to have access to user's direct messages, Twitter API ME developers were not longer able to access DMs from their apps. Before v1.8, only xAuth was supported.
Other great thing about OAuth is that developers will no longer need to request xAuth permission to Twitter for their apps keys, in order to start working with the API. Since OAuth flow is more secure, Twitter trusts promptly any registered app, because there is no way for apps to get access to user's password. So, no more you have to wait days or until your app is done, so Twitter decides to grant you permission.
It is also important to point out, OAuth is available for all platforms supported: Java ME, Android and RIM.
Besides OAuth, Twitter API ME 1.8 comes with other news:
- Possibility to configure additional connection parameters for RIM platform.
- Improved RIM connection string solving the issue of when the devices is subscribed to BIS.
- Geo-located Trend search based on Yahoo! Where On Earth ID.
- Bug fixes and replacement of some deprecated Twitter API's resources.
I am really glad to have one more version of this successful project released. In addition, I would also like to thank everybody that contributed with the project, reporting bugs and requesting new features through our Express Support.
I strongly recommend you to migrate to v1.8 right away. So, download it now from here. I also prepared some sample apps to help developers to understand how to integrate OAuth into their apps. Just click here and have fun.
See you in the next post...
Showing posts with label xauth. Show all posts
Showing posts with label xauth. Show all posts
Oct 6, 2011
Oct 8, 2010
xAuth lib: OAuth made easy
Hi all,
Nowadays, important sites on web are growing their presence in mobile space. As usual, a quick way to go in this direction is releasing mobile versions of their sites. On the other hand, they also use to provide means so third-party sites and apps can access their content and services. For instance, many sites (or platforms), e.g., Google, Yahoo, Facebook
, Twitter
, etc, provide APIs, so that developer can build their products that rely on content from them.
To start accessing any content or service from one of those sites, you first need to authenticate with it. The site needs to recognize you so it can open their doors for you. The type of authentication may vary depending on each site. It is commom to encounter with Http Basic Auth, which is very easy to work with. However, most services are shifting to OAuth. A more secure auth mechanism that also avoids third-party sites have access to user's credentials. Recently, Twitter turned off its Http Basic Auth, to support only OAuth. Some sites still work with both, but it is matter of time so they keep only OAuth.
Due to some aspects of OAuth, its pure implementation is not feasible for desktop and mobile apps. This is related to a spec flow that demands your app to be redirected forth/back to/from a login page. It is kind of complicated to accomplish that in a mobile app, for instance. To avoid this step, they created xAuth, which is same as OAuth, but the login page flow.
An OAuth request is quite more complicated to perform, since it requires a signature for the request, which uses some hash algoritms and encoders. To now more about it, click here.
In my Twitter API ME project, I had to implement it, since as I previously said, Twitter turned off Http Basic Auth. However, my xAuth implementation was designed to be reused by other apps and frameworks. So, if you are looking for xAuth lib for your app, you are at the right place. So, to start it up, download the latest version of Twitter API ME at www.twitterapime.com.
Below I will put some code snippets that demonstrate how to get authenticated to Twitter and then post a tweet. After downloading the API, you will need to obtain your app's OAuth keys: consumer key and secret. They will be used to produce that signature I mentioned ealier. Those keys are provided by the site you want to connect with, after a quick subscription. Let's show some code:
Basically what we do is to sign each request, using XAuthSigner class, as we see in the lines 4 and 13. As soon as you get authenticated, you will obtain your access token (line 8). From this point on, every request will be signed using your keys and token. This token, in turn, can be stored for further use. It avoids requesting user's credentials next time and skip auth step.
I recommend before trying to access any site using xAuth, that read its documentation first, so you can see whether they require an additional procedure to work with xAuth. I am mentioned that, because Twitter, for instance, demands us to send an e-mail to them requesting privileges to use xAuth in our apps. Otherwise, it will not work. So be aware of that.
So, that's all guys! I hope it be useful for all of you.
See you in the next post...
Nowadays, important sites on web are growing their presence in mobile space. As usual, a quick way to go in this direction is releasing mobile versions of their sites. On the other hand, they also use to provide means so third-party sites and apps can access their content and services. For instance, many sites (or platforms), e.g., Google, Yahoo, Facebook
, Twitter, etc, provide APIs, so that developer can build their products that rely on content from them.To start accessing any content or service from one of those sites, you first need to authenticate with it. The site needs to recognize you so it can open their doors for you. The type of authentication may vary depending on each site. It is commom to encounter with Http Basic Auth, which is very easy to work with. However, most services are shifting to OAuth. A more secure auth mechanism that also avoids third-party sites have access to user's credentials. Recently, Twitter turned off its Http Basic Auth, to support only OAuth. Some sites still work with both, but it is matter of time so they keep only OAuth.
Due to some aspects of OAuth, its pure implementation is not feasible for desktop and mobile apps. This is related to a spec flow that demands your app to be redirected forth/back to/from a login page. It is kind of complicated to accomplish that in a mobile app, for instance. To avoid this step, they created xAuth, which is same as OAuth, but the login page flow.
An OAuth request is quite more complicated to perform, since it requires a signature for the request, which uses some hash algoritms and encoders. To now more about it, click here.
In my Twitter API ME project, I had to implement it, since as I previously said, Twitter turned off Http Basic Auth. However, my xAuth implementation was designed to be reused by other apps and frameworks. So, if you are looking for xAuth lib for your app, you are at the right place. So, to start it up, download the latest version of Twitter API ME at www.twitterapime.com.
Below I will put some code snippets that demonstrate how to get authenticated to Twitter and then post a tweet. After downloading the API, you will need to obtain your app's OAuth keys: consumer key and secret. They will be used to produce that signature I mentioned ealier. Those keys are provided by the site you want to connect with, after a quick subscription. Let's show some code:
01. HttpRequest req = new HttpRequest("https://api.twitter.com/oauth/access_token");
02. req.setMethod(HttpConnection.POST);
02. req.setMethod(HttpConnection.POST);
03. XAuthSigner signer = new XAuthSigner("", "");
04. signer.signForAccessToken(req, "", "");
05. try {
06. HttpResponse resp = req.send();
07. if (resp.getCode() == HttpConnection.HTTP_OK) {
08. Token accessToken = Token.parse(resp.getBodyContent());
09. req.close();
10. req = new HttpRequest("http://api.twitter.com/1/statuses/update.xml");
11. req.setMethod(HttpConnection.POST);
12. req.setBodyParameter("status", "");
13. req.setSigner(signer, accessToken);
14. resp = req.send();
15. }
16. } catch (IOException e) {
17. e.printStackTrace();
18. } finally {
19. try {
20. req.close();
21. } catch (IOException e) {}
22. }
04. signer.signForAccessToken(req, "
05. try {
06. HttpResponse resp = req.send();
07. if (resp.getCode() == HttpConnection.HTTP_OK) {
08. Token accessToken = Token.parse(resp.getBodyContent());
09. req.close();
10. req = new HttpRequest("http://api.twitter.com/1/statuses/update.xml");
11. req.setMethod(HttpConnection.POST);
12. req.setBodyParameter("status", "
13. req.setSigner(signer, accessToken);
14. resp = req.send();
15. }
16. } catch (IOException e) {
17. e.printStackTrace();
18. } finally {
19. try {
20. req.close();
21. } catch (IOException e) {}
22. }
Basically what we do is to sign each request, using XAuthSigner class, as we see in the lines 4 and 13. As soon as you get authenticated, you will obtain your access token (line 8). From this point on, every request will be signed using your keys and token. This token, in turn, can be stored for further use. It avoids requesting user's credentials next time and skip auth step.
I recommend before trying to access any site using xAuth, that read its documentation first, so you can see whether they require an additional procedure to work with xAuth. I am mentioned that, because Twitter, for instance, demands us to send an e-mail to them requesting privileges to use xAuth in our apps. Otherwise, it will not work. So be aware of that.
So, that's all guys! I hope it be useful for all of you.
See you in the next post...
Subscribe to:
Posts (Atom)