Twitter第三方登录接入方案

概述

Twitter使用3-legged方式获取Access Token，3-legged包含三个角色：Consumer(消费方，app)、Service Provider(服务提供者,Twitter)、User(用户)
针对上面三个角色鉴权流程分为三步：

1. 消费方请求Request Token
2. 让用户进行身份验证，并向消费者应用程序发送Request Token
3. 消费方用Request Token请求服务提供者获取Access Token

Oauth鉴权流程

Twitter 鉴权实现

Step 1: POST oauth/request_token

消费者应用请求以Twitter获取Request Token
返回：

oauth_token=OAUTH_TOKEN
oauth_token_secret=OAUTH_TOKEN_SECRET
oauth_callback_confirmed=true

Step 2: GET oauth/authorize

让用户进行身份验证，并向消费者应用程序发送Request Token
将用户重定向到的示例 URL：

https://api.twitter.com/oauth/authorize?oauth_token=NPcudxy0yU5T3tBzho7iCotZ3cnetKwcTIRlX0iwRl0

身份验证成功后，您将收到包含和参数callback_url的请求。应用程序应验证令牌是否与步骤 1 中收到的请求令牌相匹配。oauth_tokenoauth_verifier
来自客户端重定向的请求：

https://yourCallbackUrl.com?oauth_token=NPcudxy0yU5T3tBzho7iCotZ3cnetKwcTIRlX0iwRl0&oauth_verifier=uw7NjWHT6OJ1MpJOXsHfNxoAhPKpgI8BlYDhxEjIBY

Step 3: POST oauth/access_token

消费方用Request Token请求Twitter获取Access Token
请求案例

POST /oauth/access_token
oauth_consumer_key=cChZNFj6T5R0TigYB9yd1w
oauth_token=NPcudxy0yU5T3tBzho7iCotZ3cnetKwcTIRlX0iwRl0
oauth_verifier=uw7NjWHT6OJ1MpJOXsHfNxoAhPKpgI8BlYDhxEjIBY

返回值

oauth_token=7588892-kagSNqWge8gB1WwE3plnFsJHAZVfxWD7Vb57p0b4
oauth_token_secret=PbKfYqSryyeKDWz4ebtY3o5ogNLG11WJuZBc9fQrQo

Step 4: GET account/verify_credentials
服务端在调用Twitter API 时需要使用oauth_token、oauth_token_secret 进行身份认证；
请求案例

POST /oauth/access_token
oauth_consumer_key=cChZNFj6T5R0TigYB9yd1w
oauth_consumer_secret=NPcudxy0yU5T3tBzho7iCotZ3cnetKwcTIRlX0iwRl0
oauth_token=7588892-kagSNqWge8gB1WwE3plnFsJHAZVfxWD7Vb57p0b4
oauth_token_secret=PbKfYqSryyeKDWz4ebtY3o5ogNLG11WJuZBc9fQrQo

返回值：

Uid
userName

Twitter 权限认证服务端实现

使用Twitter4j接入Twitter API
https://github.com/Twitter4J/Twitter4J

<dependency>
    <groupId>org.twitter4j</groupId>
    <artifactId>twitter4j-core</artifactId>
    <version>4.0.7</version>
</dependency>

Twitter凭证校验

public User verifyCredentials(String accessToken, String accessTokenSecret) {
    ConfigurationBuilder builder = new ConfigurationBuilder();
    builder.setOAuthConsumerKey("CONSUMER-KEY");
    builder.setOAuthConsumerSecret("CONSUMER-SECRET");
    builder.setOAuthAccessToken(accessToken);
    builder.setOAuthAccessTokenSecret(accessTokenSecret);
    builder.setDebugEnabled(true);
    Twitter twitter = new TwitterFactory(builder.build()).getInstance();
    User user = null;
    try {
        user = twitter.users().verifyCredentials();
    } catch (TwitterException e) {
        LOGGER.error("credentials verify error.accessToken={},accessTokenSecret={}", accessToken, accessTokenSecret,
                e);
        throw new GhException(AthenaErrorEnum.BAD_REQUEST, e);
    }
    return user;
}

Twitter 术语

在Twitter开发者文档中不同术语含义是一样的。

1.客户端凭证
App Key == API Key == Consumer API Key == Consumer Key == Customer Key == oauth_consumer_key
App Key Secret == API Secret Key == Consumer Secret == Consumer Key == Customer Key == oauth_consumer_secret
Callback URL == oauth_callback

2.临时凭证
Request Token == oauth_token
Request Token Secret == oauth_token_secret
oauth_verifier

3.Token 凭证
Access token == Token == resulting oauth_token
Access token secret == Token Secret == resulting oauth_token_secret

Twitter官方文档
https://developer.twitter.com/en/docs/authentication/oauth-2-0/authorization-code
https://developer.twitter.com/en/docs/authentication/oauth-1-0a/obtaining-user-access-tokens