OAuth

OAuth is an open protocol to allow secure API authorization in a simple and standard method from desktop and web applications.

On April 23, 2009, a security advisory was released after major vendors, such as Twitter, implemented fixes for the security hole. The security hole was in the OAuth request token approval flow. http://oauth.net/advisories/2009-1

Background

The OAuth project was started in November 2006 when Blaine Cook was working on Twitter's OpenID implementation (which was never publicly released). Blaine needed a way to allow users, who use OpenIDs to authenticate, to have access to API resources. Blaine gathered quite a few people to join the conversation on how this problem could be solved.

On December 4, 2007, the OAuth 1.0 spec was released into the wild. Many companies, including Flickr, Google, Pownce, and Twitter implemented OAuth to allow access to protected resources through authorization, instead of relying on users to give their password out to anyone who asks.

OAuth Answers

Save Cancel

Search for Questions
Preview

Why a request token is needed in OAuth?(1 Answer)

A: The Request Token in oauth plugin is used for the Authentication phase of the Oauth protocol.This is only used from the Consumer Service side. You ask a ...

Does anyone still use Twitter apps that ask for your twitter password, when OAuth now eliminates that need?(1 Answer)

A: Unfortunately, yes. Many desktop apps haven't yet moved over to OAuth because Twitter's desktop OAuth implementation was just released recently. Also, many Twitter mashups (web mashups ...

Why does Mahalo's "Click to send your question to Twitter" option ask for my Twitter password instead of using secure OAuth?(1 Answer)

A: Mahalo's send your question to Twitter existed before Twitter supported OAuth. OAuth on Twitter is a relatively new thing and it will take a while before Mahalo ...