search

FusionAuth / fusionauth-issues

FusionAuth issue submission project
https://fusionauth.io
91 stars 12 forks source link

Update Twitter to Use OAuth 2 #2044

Open mooreds opened 1 year ago

mooreds commented 1 year ago

Update Twitter to Use OAuth 2

Problem

Currently we support OAuth1.0 for twitter https://fusionauth.io/docs/v1/tech/apis/identity-providers/twitter

Looks like Twitter supports OAuth2 now: https://developer.twitter.com/en/docs/authentication/oauth-2-0

This would let us store the refresh token and probably simplify the codebase. Maybe keep the old identity provider around and add a Twitterv2?

Solution

We should update the twitter identity provider to use the newer protocol.

Alternatives/workarounds

n/a

Additional context

Came up in a twitter DM conversation with a community member.

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

How to vote

Please give us a thumbs up or thumbs down as a reaction to help us prioritize this feature. Feel free to comment if you have a particular need or comment on how this feature should work.

robotdan commented 1 year ago

Twitter has supported OAuth for a long time, however - as far as I am aware this authentication is only available for application developers integrating with their APIs - and not for the "Login with Twitter" button.

https://developer.twitter.com/en/docs/authentication/guides/log-in-with-twitter

https://developer.twitter.com/en/docs/authentication/oauth-2-0

OAuth 2.0 Bearer Token authenticates requests on behalf of your developer App. As this method is specific to the App, it does not involve any users. This method is typically for developers that need read-only access to public information.

If Twitter does support OAuth 2.0 (Auth code grant) for login, then we should definitely use it, but I don't believe this is possible.

mooreds commented 1 year ago

https://developer.twitter.com/en/docs/authentication/oauth-2-0/user-access-token looks like login with twitter to me, and a similar pattern to the other idps. What am I missing?

robotdan commented 1 year ago

Ok, maybe I'm mistaken. When I search for the Login with twitter options, I only see the OAuth 1 options.. and I know in the past they did support OAuth 2.0 but not for the login workflow.

I was able to log into my dev account and create OAuth 2.0 credentials with a call back, so perhaps it will work. We can investigate further.

robotdan commented 4 months ago

If we make any updates here, we may want to review our API usage to see if we are still compatible with the X APIs.