Suddenly Sign in with Twitter is not working

[anmolagar]

We are having issues with the Passport-Twitter auth strategy now that Twitter deployed a new callback URL setting change. Can you help us fix this as we have users who are blocked from our site. Any assistance would be much appreciated. We are trying to pass callbackURL in authentication function instead of strategy. Its been working for over 2 years until yesterday.

Here is a sample of our code:

router.get('/fan/register/twitter',
    passport.authenticate('twitter',{callbackURL: '/member/fan/register/twitter/return'})
);

// step 2
router.get('/fan/register/twitter/return',
  passport.authenticate('twitter', { failureRedirect: '/error' }),
  function(req, res) {
    
  console.log("fan register twitter with success------------------" , req.user);
  //var username = req.user._json.screen_name;
  //username = username.toLowerCase();
  req.session.twitterUser = req.user;

action-required-sign-in-with-twitter-users-must-whitelist-callback-urls

FYI, we have made all the changes in app settings as per the link above
Thanks!

[mxstbr]

The callbackURL has to be absolute, something like: https://mysite.com/member/fan/register/twitter/return. You then have to copy and paste that exact URL into your Twitter Apps settings under "Callback URLs".

Yes, it's very annoying that you have to hard-code them now. Unfortunately, there isn't much we can do 😕

[marrs]

@anmolagar did that work for you? I'm having the same issue when calling back to locally tested code. I explicitly set the callback URL as http://127.0.0.1:PORT/path/to/callback in twitter and in my code but with no change to the outcome.

[anmolagar]

yeah, that worked for me.
Thanks @mxstbr
Also for mobile you need to add exact urlScheme in callback urls on apps.twitter.com for eg: myappname://
Now the problem is, i have so many different callback urls based on the functionality and twitter is limiting to only few in app settings :(

[marrs]

I got it working as well. My issue turned out to be that the API keys had changed around the same time. Don't know if that was my end or Twitter's end. So failure ended up being to do with key mismatch, not callback mismatch.

[hadyrashwan]

Is there is anyway around the the explicit url part . I'm authorizing the user by connecting his account to twitter so I need to send a jwt with the callback so I can match the user with his twitter account