为什么我的twitter oauth访问令牌无效/过期

Question

我使用Twitter将用户登录到一个网站,这似乎一直在努力,直到我尝试获得有效的访问令牌.

require("twitteroauth.php");
require 'twconfig.php';
session_start();

$twitteroauth = new TwitterOAuth(YOUR_CONSUMER_KEY, YOUR_CONSUMER_SECRET);
$request_token = $twitteroauth->getRequestToken('http://****/tw_response.php');

$oauth_token = $request_token['oauth_token'];
$_SESSION['oauth_token'] = $oauth_token;

$oauth_token_secret = $request_token['oauth_token_secret'];
$_SESSION['oauth_token_secret'] = $oauth_token_secret;

if ($twitteroauth->http_code == 200) {
    url = $twitteroauth->getAuthorizeURL($request_token['oauth_token']);
    header('Location: '.$url);
} else {
    die('Something wrong happened.');
}

这似乎工作正常,将我重定向到Twitter登录并确认访问,之后它返回到tw_response.php(我的回调网址),网址中包含以下变量:

http://example.com/login.php?oauth_token=sO3X...yj0k&oauth_verifier=Ip6T...gALQ 

在tw_response.php中,我然后尝试获取访问令牌,但它报告为无效.我尝试使用以下var_dump方式查看访问令牌的内容:

require("twitteroauth.php");
require 'twconfig.php';
session_start();

$oauth_verifier = $_REQUEST['oauth_verifier'];
$oauth_token = $_SESSION['oauth_token'];
$oauth_token_secret = $_SESSION['oauth_token_secret'];

$twitteroauth = new TwitterOAuth(YOUR_CONSUMER_KEY, YOUR_CONSUMER_SECRET, $oauth_token, $oauth_token_secret);

$access_token = $twitteroauth->getAccessToken($data['oauth_verifier']);
var_dump($access_token);

var_dump"无效/过期令牌"结尾的结果:

array(8) {
    ["oauth_url"] => string(104) ""1.0" encoding="UTF-8"?>/oauth/access_token?oauth_consumer_key=ceE...9Dg"
    ["oauth_nonce"]=> string(32) "c52...d07"
    ["oauth_signature"]=> string(28) "ry7...Fcc="
    ["oauth_signature_method"]=> string(9) "HMAC-SHA1"
    ["oauth_timestamp"]=> string(10) "1359031586"
    ["oauth_token"]=> string(40) "sO3...j0k"
    ["oauth_verifier"]=> string(43) "Ip6...ALQ"
    ["oauth_version"]=> string(63) "1.0 Invalid / expired Token "
}

Answer 1

$access_token = $twitteroauth->getAccessToken($data['oauth_verifier']);
var_dump($access_token);

哪里$data奇迹般地从何而来？您有变量$oauth_verifier,但请记住,如果这是您注册的回调URL,则不需要此变量.

由于您在内部使用了无效变量getAccessToken,因此它将返回无效值.

使用TwitterOAuth的正确方法:

if (!isset($_GET["oauth_token"])) {
    // set these values in a config file somewhere.
    $twitter = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET);

    // append a ?. This is your callback URL if you specify something.
    $credentials = $twitter->getRequestToken("http://example.com/test.php?");

    // try and be a bit more elegant with the URL... This is a minimal example
    $url = $twitter->getAuthorizeUrl($credentials);
    echo $url;

    // these are temporary tokens that must be used to fetch the new,
    // permanent access tokens. store these in some way,
    // session is a decent choice.
    $_SESSION["token"] = $credentials["oauth_token"];
    $_SESSION["secret"] = $credentials["oauth_token_secret"];
} else {

    // use the user's previously stored temporary credentials here
    $twitter = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET,
                    $_SESSION["token"], $_SESSION["secret"]);

    // uses the oauth_token (from the request) already.
    // you store these credentials in your database (see below).
    $credentials = $twitter->getAccessToken($_GET["oauth_verifier"]);

    // just a printout of credentials. store these, don't display them.
    echo "<pre>";
    var_dump($credentials);
    // valid credentials, provided you give the app access to them.
    echo "</pre>";
}

我只使用一个脚本进行回调以方便使用; 如果您愿意,可以将相关部分拆分为多个脚本(您可能应该这样做).

对于您的数据库,凭据也包括Twitter用户的用户名.
编辑:Twitter现在为用户ID分配64位整数.您应该将其存储为字符串,以确保在应用程序的每个部分都无法处理64位整数时,不会导致错误的用户ID和冲突.

array(4) {
  ["oauth_token"]=>
  string(50) "7041...wYupkS"
  ["oauth_token_secret"]=>
  string(42) "O9ENq...21B2fk"
  ["user_id"]=> // user ID. always the same, never changes (store this as ID)
  string(9) "..."
  ["screen_name"]=> // username. can change.
  string(11) "..."
}

所以,如果你想登录的用户在通过Twitter,没有明确地给他们登录到你的网站,你可以使用$_SESSION(我用的数据库为我登录,这是建议,如果你想保存状态),在你将上面的脚本将其添加到else块的末尾:

$_SESSION["token"] = $credentials["oauth_token"];
$_SESSION["secret"] = $credentials["oauth_secret"];
$_SESSION["username"] = $credentials["screen_name"];

GET account/verify_credentials如果你想给他们一个用户页面,你也可以获得用户的屏幕名称等等(如果你使用javascript,请通过id_str这里获取用户ID ):

$user_array = $twitter->get("account/verify_credentials");