OAuth 1.0A on Node-Red
npm install node-red-contrib-oauth1aWith OAuth 1.0A, you sign the URL being used to access protected resources.
Even though there is already OAuth 2.0, there are companies, many of them are financial institutions,
still intentionally use OAuth 1.0A.
In case of Twitter, using OAuth 1.0A, you can allow apps to access user's private information and act on behalf of the user.
Using OAuth 2.0, Twitter only allow apps to read publicly available information.
When registering your app to access resources, such as Twitter or Facebook data, you will be given a consumer key.
A consumer key identifies your app.
You will also be given an initial token to access authentication related resources.
Using authentication and authorization flow, you will escalate that initial token to a new token, usually called an access token,
that allows you access more interesting resources.
Both consumer key and token are protected by secret strings, so after registering your app, you will likely be given
this 4 values:
OAUTH_CONSUMER_KEY, OAUTH_CONSUMER_SECRET, OAUTH_TOKEN, and OAUTH_TOKEN_SECRET.
You should never let other people know your OAUTH_CONSUMER_SECRET and OAUTH_TOKEN_SECRET.
For security purpose, if you push your flows to a git repository,
don't store the 4 values in a flow. Instead, use environment variable.
For example:
``
export OAUTH_CONSUMER_KEY=...
export OAUTH_CONSUMER_SECRET=...
export OAUTH_TOKEN=...
export OAUTH_TOKEN_SECRET=...The oauth1a Node
This package provides 1 node, the oauth1a node, that accepts URL to be signed and some values to be able to sign
that URL.
After signing the URL, the node will access the resource located on that URL and returns the response data to the next node.
The basic nodes configuration will consist of:
1. a function node that prepares values on msg.payload,msg
2. an oauth1a node that receives an sent by the function node,
3. another function node that uses the response of URL accessed by oauth1a node.
Here are some examples on how you can use oauth1a node on Twitter resources.
Create a function node that returns an msg containing request token URL:`
msg.payload = {
consumerSecret: env.get("TWITTER_API_SECRET_KEY"),
tokenSecret: env.get("TWITTER_ACCESS_TOKEN_SECRET"),
url: 'https://api.twitter.com/oauth/request_token',
httpMethod: 'POST',
parameters: {
oauth_callback: env.get("TWITTER_AUTH_CALLBACK_URL"),
oauth_consumer_key: env.get("TWITTER_API_KEY"),
oauth_token: env.get("TWITTER_ACCESS_TOKEN"),
oauth_signature_method: 'HMAC-SHA1',
}
};
return msg;
The payload contains an object that has these components:
1. The URL of a resource that will be accessed by oauth1a node.
2. Secrets to be used to sign parameters.
3. Parameters to be signed.
4. It can also has a body object. It will be shown on the next example. If there is a body object, it will also need
to be put on parameters to be signed.
Link the output of that function node to the input of an oauth1a node.
oauth1a node accesses the signed URL and captures the response in msg.payload.data.
msg.payload.data of the response of request token URL contains a new oauth_token and oauth_token_secret
to be used on Twitter auth page: .
Once authentication on Twitter auth page is successful, the browser page will be redirected to your own URL atenv.get("TWITTER_AUTH_CALLBACK_URL")?oauth_verifier=.
Your callback URL from the previous example receives oauth_verifier. We will use that value to sign Twitter msg
access token URL. In order to do that, we need to prepare the in a new function node: `
msg.payload = {
consumerSecret: env.get("TWITTER_API_SECRET_KEY"),
tokenSecret:
url: 'https://api.twitter.com/oauth/access_token',
httpMethod: 'POST',
parameters: {
oauth_consumer_key: env.get("TWITTER_API_KEY"),
oauth_token: msg.req.query.oauth_token,
oauth_signature_method: 'HMAC-SHA1',
oauth_verifier: msg.req.query.oauth_verifier,
},
body: {
oauth_verifier: msg.req.query.oauth_verifier,
}
};
return msg;
Just like the previous example, link the output of the new function node to the input of a new oauth1a node.
Just like the previous example, oauth1a node will output and msg.payload.data.oauth_token_secret.
However, those new tokens can be used to access Twitter features such as reading timeline or posting tweets.
After succesfully tries the previous example, you are ready to access Twitter feature endpoints such as https://api.twitter.com/1.1/statuses/home_timeline.json.
Prepare the msg to sign that endpoint URL on a new function node:`
msg.payload = {
consumerSecret: env.get("TWITTER_API_SECRET_KEY"),
tokenSecret: msg.payload.data.oauth_token_secret,
url: 'https://api.twitter.com/1.1/statuses/home_timeline.json?include_entities=true',
httpMethod: 'GET',
parameters: {
oauth_consumer_key: env.get("TWITTER_API_KEY"),
oauth_token: msg.payload.data.oauth_token,
oauth_signature_method: 'HMAC-SHA1',
include_entities: 'true',
}
};
return msg;
Connect its output to the input of a new oauth1a node.
The output of oauth1a node is the output of the twitter endpoint above.