3 ms·

Does twitter honor the the oauth_callback parameter? Otherwise, how can those keys be used by an attacker?

• cheald 14y ago
  oauth_callback is only interesting for web app authorization. For out-of-band authorization flows, you can't protect it with a callback filter. Since these keys were lifted from an application that does out-of-band auth flows, any other app could use them similarly at will.
  • abraham 14y ago
    The Twitter apps don't use the OOB flow. They use xAuth password exchange "flow".
    • arthulia 14y ago
      Nope, untrue. Read the description for oauth_callback. https://dev.twitter.com/docs/api/1/post/oauth/request_token https://dev.twitter.com/docs/api/1/post/oauth/request_token