Using javascript with the twitter API

Question

I'm interested in making a twitter client using Adobe Air, but I'm kinda stuck right now, as I can't figure out a better way to connect to the twitter REST API since it needs authentication.

Currently, the client sends a request to my server (a php script using curl) with the twitter username/password (unencrypted) in GET variables. The server then makes a request to twitter using those credentials and outputs the buffer, which gets sent back to the client, which then processes/displays it.

This obviously is a horrendous security hole, so does anyone know of a better (more secure) way of doing it?

FYI: I'm using jQuery.

Solution

There are a few Base64 Encoding tools out there. You can use one of them. You can add a header with the encoded username and password based on the Basic Auth specs

Here is a post that does exactly what you want. http://www.aswinanand.com/blog/2009/01/http-basic-authentication-using-ajax/. The base64 is encoded using this library from ostermiller.org

$.ajax({    
  'url': 'http://twitter.com/action/',
  'otherSettings': 'othervalues',
  'beforeSend': function(xhr) {
    xhr.setRequestHeader("Authorization", "Basic  " + 
                          encodeBase64(username + ":" + password));
  },
  sucess: function(result) {
   alert('done');
  }
});

Comments

[user3788101]

true, but last I checked. twitter only supports basic.

[DEfusion]

I still get a login prompt when using this technique in FF 3.6.11 - has something changed?

[DEfusion]

I've found this question (stackoverflow.com/questions/86105/…) that seems to suggest you can't avoid the browsers default login prompt if the details are incorrect.

[Josh]

Should be xhr.setRequestHeader("Authorization", "Basic " + encodeBase64(username + ":" + password)

[Anikeev Gennadiy]

How do you use the encodeBase64 library? There doesn't seem to be a script to download?

[KingRider]

function encodeBase64 not defined in jquery, try use BTOA(username + ":" + password)