My favorites | Sign in
Project Logo
       
New issue | Search
for
| Advanced search | Search tips
Issue 559: oauth/authenticate?force_login=true problem with multiple accounts
4 people starred this issue and may be notified of changes. Back to list
Status:  Fixed
Owner:  m...@twitter.com
Closed:  May 29
Component-OAuth
Type-Defect
Priority-High


Sign in to add a comment
 
Reported by paul.kinlan, May 06, 2009
I belive there is a problem with Twitter OAuth Authentication in
combination with the force_login=true parameter

The issue occurs only when I am logged in to twitter.com with one user and
I need to use OAuth Authentiation and force_login=true against another user.

The applications that I can replicate this problem in are: 
http://twitter.com/oauth_clients/details/1827
http://twitter.com/oauth_clients/details/2475

These two applications are hosted on the Google App Engine, created in
Python using TwitterOAuthClient.py package on GoogleCode.  I don't belive
it is a platform issue.

Steps to reproduce:

Pre-req
You must have two accounts on twitter: UserA and UserB

1. Login to the Twitter site with a user account (UserA)
2. Go to an application that uses Twitter OAuth authentication and
force_login=true OAuth url.
3. Attempt to login to the site
3a. The site will get a request token and direct you to the appropriate
authentication url
(http://twitter.com/oauth/authenticate?force_login=true&oauth_token=[[REQUESTTOKEN]])
4. Twitter presents a page requesting that the username and password.
5. Login with UserB's credentials
6. You will be redirected to the application's site
6a. The application will parse the token, request an access token.

It appears that the twitter.com site at step 5 is assigning the request
token to UserA and not the authenticating UserB, so when steps 5a obtains
an access_token it is infact obtaining the token for UserA.

7. A request to verify_credentials.json will show that the tokens are
assigned to UserA's credentials and not UserB.
Comment 1 by m...@twitter.com, May 06, 2009
Emailed with the requester before filing. I can reproduce the issue and have a fix underway. Working on tests for 
it so I can confirm it fixes the issue.
Status: Accepted
Owner: m...@twitter.com
Labels: Type-Defect Priority-High
Comment 2 by emartin24, May 09, 2009
Just ran into the same issue. Any updates?
Comment 3 by m...@twitter.com, May 11, 2009
I have a fix for this issue awaiting review.
Comment 4 by yoav.aviram, May 24, 2009
Same problem here, updates?
Comment 5 by m...@twitter.com, May 28, 2009
The fix planned for deploy did not work in all cases. Working on a second fix now.
Comment 6 by m...@twitter.com, May 29, 2009
Follow-up fix was deployed and everything looks correct now.
Status: Fixed
Sign in to add a comment

Hosted by Google Code