Why do users have to enter a 7-digit twitter PIN to grant my application access?

Question

I am implementing some ruby on rails code tweet stuff for my users. I am creating the proper oauth link...something like

http://twitter.com/oauth/authorize?oauth_token=y2RkuftYAEkbEuIF7zKMuzWN30O2XxM8U9j0egtzKv

But after my test account grants access to twitter, it pulls up a page saying "You've successfully granted access to . Simply return to and enter the following PIN to complete the process. 1234567"

I have no idea where the user should enter this PIN and why they have to do that. I don't think this should be a necessary step. Twitter should be redirecting the user to the callback URL I provided in the application settings. Does anyone know why this is happening?

UPDATE I found this article that states I need to send my users to this URL (note "authenticate" instead of "authorize"):

http://twitter.com/oauth/authenticate?oauth_token=y2RkuftYAEkbEuIF7zKMuzWN30O2XxM8U9j0egtzKv

I made the change but Twitter redirects the user to the authorize path after he clicks "Allow" which then gives him the 7 digit PIN again!

Answer 1

OAuth 1.0a added the PIN to solve a social engineering attack to which OAuth 1.0 was vulnerable. But the PIN is only necessary to be entered manually by the user if your application is a desktop/iphone app. If it's a web app the PIN should flow automatically as part of the browser redirects and the user shouldn't have to see or enter this.

So if your app is a web app, then there's a bug either in your OAuth library or your use of it. If your app is a desktop app, this is a "feature" designed to keep your users safe.

Answer 2

If you don't specify an oauth_callback parameter with the URL you'd like the user redirected to when they accept, it will default to the pin-based authentication mechanism. Using oauth_callback=oob will also trigger the pin-based authentication flow.

Answer 3

Just log in to you twitter account and edit the application to change from Desktop to Browser Everybody is doing that mistake including myself.