Pueblo Computing

Earlier this year, Twitter announced that it would be ending support of Basic Authentication (or Authentication through a username/password combination). The date has now been set as April 30, 2010. As of that date, basic authentication will no longer be allowed and all apps connecting to Twitter will be required to use oAuth.

One problem with transferring from Basic to xAuth is with applications who use a lot of different accounts for legitimate purposes. These may be web applications used for a lot of different people OR desktop apps installed on a lot of computers. A lot of these computers still have the username/password. To make it easier to transition Twitter is offering xAuth access. xAuth generates the tokens through the user of the applications own consumer keys (public and secret) and the username/password combination. These can be sent without use of a browser, which can be good for programs residing on servers and other devices that don’t have human interaction. And now you can convert your application over with the latest version of TwitterVB, 2.5. By using TwitterVB you can isolate yourself from the messy business of generating http signatures and proper encoding and focus on your application.

How to transfer?

Before you transfer you need to get permission for your application to use xAuth. If you do not, any code you write based on what is below will bounce off with a 401 unauthorized error. Before that, however, you need to set up your application to use oAuth. Visit Twitter.com and register your client application. You’ll need the client’s name, function, URLs, and whether it just needs read access or read/write access. Once you fill that out you will be presented with a page with two long strings, the consumer key and the consumer secret. These are needed to sign your requests.

There’s also one other number you should write down. The URL will have a  number at the end is your application’s ID. That will be very important in order to turn on xAuth access in a moment. Next, we need to ask permission for your app to access xAuth. Send an e-mail with the ID, name of your app, and a description of why your app needs xAuth (either permanently or temporarily) to api at twitter dot com. Typically you can expect a response within 8 business hours.

How to implement

For the following examples. I am going to create a simple Console application that logs in, prints everything off my public timeline, and leaves. I create the console application, and then I go into the project settings and set four string variables:
*m_strConsumerKey
*m_strConsumerSecret
*m_strToken
*m_strTokenSecret
These will all be accessed through the My.Settings namespace. I set the ConsumerKey and ConsumerSecret to what I received on the page where I registered my program and added a reference to TwitterVB (making sure that it’s at least the 2.5 version)

Next, I write the following code:

Imports TwitterVB2

Module Module1

    Sub Main()        Dim twConn As New TwitterAPI        Dim strPassword As String        Dim strUserName As String

        Try

            If My.Settings.m_strToken.Trim.Length = 0 Then                Console.Write("Input Username: ")                strUserName = Console.ReadLine()                Console.Write("Input Password: ")                strPassword = Console.ReadLine()                twConn.XAuth(strUserName, strPassword, My.Settings.m_strConsumerKey, My.Settings.m_strConsumerSecret)                My.Settings.m_strToken = twConn.OAuth_Token                My.Settings.m_strTokenSecret = twConn.OAuth_TokenSecret                My.Settings.Save()            Else                twConn.AuthenticateWith(My.Settings.m_strConsumerKey, My.Settings.m_strConsumerSecret, My.Settings.m_strToken, My.Settings.m_strTokenSecret)            End If

            For Each twStat As TwitterStatus In twConn.UserTimeline

                Console.WriteLine(twStat.ID.ToString() & ":" & twStat.Text)            Next            twConn.Update("Read timeline at " & DateTime.Now.ToString)

            Console.ReadKey()        Catch ex As TwitterAPIException            Console.WriteLine(ex.Message)            Console.ReadKey()        Catch ex As Exception            Console.WriteLine(ex.Message)            Console.ReadKey()        End Try

    End Sub

End Module

Run it the first time, and the user will be asked for their name and password. Run it again, and it shouldn’t have to ask for anything. It will just authenticate like any normal oAuth app browserlessly because it already has the tokens. You’ve now set up your application to use oAuth and haven’t had to open a browser window to do it either.

Caveats

By using xAuth, you are agreeing not to store the username/password combination. Once you receive the information you should delete that as a combination so that it cannot be used by somebody else. Done properly, you shouldn’t have to use this more than once for any given account. Caching user information such as the username, screenanme, etc should be okay and in fact encouraged to conserve on rate limits.
Also, while web applications can use xAuth they can only use it on a temporary basis to batch convert existing accounts on over. This means that before you ask for xAuth you should convert your site over so that it can use oAuth, then ask for xAuth access to batch convert existing accounts. Once you have converted them you should at least delete the passwords and at that point be set for using oAuth on a permanent basis.
Finally, while desktop or mobile apps may be granted a more permanent use I would not count on it. The goal should be to convert existing accounts. If there is any way to use a browser on your system then do so. Document every reason why you cannot (aesthetics probably won’t be accepted) before you request permanent xAuth.

Conclusion

With the countdown to the shutdown of Basic authentication, many applications are finding themselves stuck between a rock and a hard place. XAuth in TwitterVB should help you transition more smoothly as long as you remember it’s should only be counted on as a temporary help unless you are notified otherwise by Twitter.