php - Secure login with Twitter oAuth - best practice -

-

I'm new to oAuth and trying to create a web application using Twitter to authenticate . There will be no other login method other than Twitters oAuth. I am looking to advise on best practices for securing a site based on tokens.

  • Generate access token for user
  • Get users unique Twitter
  • ID
  • via Twitter API
    • Search for a user in local DB with this ID and locate the access token if available.
  • If there is no user, then create new line in user table and avoid user. If the user is found, then update the login token on the user's record again.
  • If the user is found, twitterid is set as md5_salt and cookie.
  • If the user re-visits, based on the lookup user cookie

    • Is this sound like a safe perspective or is there a bad idea of ​​the MD5 Twitter ID?

    Appreciate any comments.

    Without knowing what your client / consumer application is doing, it is difficult to say that The approach will be "safe".

    There is a problem I am looking at, how is it that when you receive an access token from Twitter, how is the cookie removed, how do you identify your user? Or will you need them to get a new access token? This will mean that they both login, and every time their application must be authorized.

    In addition, a token can be used for a user of your app and can be used by another user of your app. Because it acts just like a password and there is no authentication in your favor to verify your cookie saved access token.

    To answer your question, I have to say that using Oath as the only authentication provider does not make any difference to how you do it, this is not the best practice.

    To protect both the consumer (consumer) application and the server (provider) application, the identity of your users needs to be verified. The easiest way to do this is with the username and password stored in the head of your users, and not on the file anymore ...


    Comments

    Post a Comment

    Popular posts from this blog

    c# - sqlDecimal to decimal clr stored procedure Unable to cast object of type 'System.Data.SqlTypes.SqlDecimal' to type 'System.IConvertible' -

    -
    I'm new to this I'm writing a clr. stored procedure that can be used to get values ​​used in a calculation Call for another stored procedure for Gives an archived methodology int (I think SqlInt32? Value of the table's value is int) which is then necessary to convert to decimal. Here I have the code: Public static integral mood (SQL MDMMYLUE, escalistering AMY type, out of SQLDCM Result) {aResult = 0; Try {SqlConnection conn = New SqlConnection ("Reference Connection = True"); SqlCommand cmd = New SqlCommand ("sp_GetType", conn); Cmd.Parameters.AddWithValue ("@ myValueType", aMyValueType); Cmd.CommandType = CommandType.StoredProcedure; Conn.Open (); Object type = CMD. Exclamation Asser (); Conn.Close (); Decimal type FORCalculation = Convert. ToDecimal (type); Decimal value = convert toDecimal (aMyValue); // ** calculation calc = new calculation (); Decimal result = calorie.docalulation (typefarculation, value); I get an exception...
    Read more

    Calling GetGUIThreadInfo from Outlook VBA -

    -
    I need to find the active window'm writing a VBA macro in MS Outlook, which is a specific process. The goal of this is to get the active window / document name even if its original application has more than one document interface. User processor with GetCurrentThreadId is active, I am using GetGUIThreadInfo to get .dll. Here is the correct code: private type RECT as as Left LongPtr top LongPtr right LongPtr down LongPtr termination of private type GUITHREADINFO cbSize as LongPtr flags LongPtr hwndActive LongPtr hwndFocus LongPtr hwndCapture LongPtr as as as as as reset as LongPtr rcCaret as LongPtr hwndCreate as LongPtr hwndMoveSize as HwndMenuOwner end of Private Equity PtrSafe function GetWindowThreadProcessId Lib "user32" (_BVV hnw LongPtr as LongPtr Nig Mr. announced as PtrSafe function GetGUIThreadInfo Lib "user32" _ (ByVal dwthreadid as LongPtr, _ lpguithreadinfo as GUITHREADINFO) LongPtr Sub MyFunction () as dim strWindowTitle string = space as s...
    Read more

    Obfuscating Python code? -

    -
    I'm looking for a way to hide my Python source code. print "Hello World!" How can I encode this example so that it is not human-readable? I have been asked to use Base 64 but I'm not sure how. itemprop = "text"> It is limited only, first level ambiguous resolution, but has built-in: byte-code in Python Is a compiler for: dragon-o-m py_compile & lt; Your program.py & gt; creates a .pyo file with a byte-code, and where the docstrings are removed, etc. You can rename .pyo with the .py extension, and python & lt; Your program.py & gt; runs as your program, but it does not have your source code. PS : If your program blur modules like this, you need to rename them with the .pyc suffix (I Not sure it will not break a day), or you can work with .pyo and run them with python -o ... .pyo ( Import should work). This will allow dragon to search your modules (otherwise, Python looks for the .py module).
    Read more