search

CodedOre / NewCaw

Development on Cawbird 2.0
GNU General Public License v3.0
97 stars 5 forks source link

Add sign out to `Account` #30

Open CodedOre opened 2 years ago

CodedOre commented 2 years ago

At some point we need to add a method to sign an Account out and revoke the access token connected.

Since Twitter's OAuth endpoints aren't clearly documented and it's not the highest priority now, I noting it as a to-do for later.

CodedOre commented 2 years ago

So, technically this is now implemented with Account.revoke_access.

However, the current implementation does not work with Twitter. The revoke method ^1 requires the parameters such as client_id and the token to be passed on as x-www-form-urlencoded. And it seems for me like librest is encoding it as such ^2 (or I missed something). Still, the servers return only a Forbidden, without any note of what I'm doing wrong.

So, since it's technically implemented by partially broken, I keep this open for now.

IBBoard commented 2 years ago

I guess you need to intercept the traffic to see what's actually being transmitted. It's possible to get Wireshark to decrypt HTTPS (I've done it with Firefox when checking some website stuff) but it looks like it's much harder to get the initial encryption key with OpenSSL.