title: Simple Twitter Oauth authorization asking for credentials every time
body: <p>I am making a simple twitter based login/signup system using the tutorial <a href="http://www.1stwebdesigner.com/tutorials/twitter-app-oauth-php/" rel="nofollow">here</a>. I get the  oauth_token as well as oauth token secret every time I get the user to login. However, even when the user is already logged in, he is being asked to login again. I just wanted to know how do I check if the user is already logged in?</p>
  
  <p>Do I need to store the oauth_token and oauth token secret in session? If I do store these in a session, how do i authenticate if they are valid?</p>
  
  <p>The library used has something like this:</p>
  
  <pre><code>&lt;?php
  session_start();
  class EpiOAuth
  {
    public $version = '1.0';
  
    protected $requestTokenUrl;
    protected $accessTokenUrl;
    protected $authorizeUrl;
    protected $consumerKey;
    protected $consumerSecret;
    protected $token;
    protected $tokenSecret;
    protected $signatureMethod;
  
    public function getAccessToken()
    {
      $resp = $this-&gt;httpRequest('GET', $this-&gt;accessTokenUrl);
      return new EpiOAuthResponse($resp);
    }
  
    public function getAuthorizationUrl()
    {  
      $retval = "{$this-&gt;authorizeUrl}?";
      $token = $this-&gt;getRequestToken();
      return $this-&gt;authorizeUrl . '?oauth_token=' . $token-&gt;oauth_token;
    }
  
    public function getRequestToken()
    {
      $resp = $this-&gt;httpRequest('GET', $this-&gt;requestTokenUrl);
      return new EpiOAuthResponse($resp);
    }
  
    public function httpRequest($method = null, $url = null, $params = null)
    {
      if(empty($method) || empty($url))
        return false;
  
      if(empty($params['oauth_signature']))
        $params = $this-&gt;prepareParameters($method, $url, $params);
  
      switch($method)
      {
        case 'GET':
          return $this-&gt;httpGet($url, $params);
          break;
        case 'POST':
          return $this-&gt;httpPost($url, $params);
          break;
      }
    }
  
    public function setToken($token = null, $secret = null)
    {
      $params = func_get_args();
      $this-&gt;token = $token;
      $this-&gt;tokenSecret = $secret;
    } 
  
    public function encode($string)
    {
      return rawurlencode(utf8_encode($string));
    }
  
    protected function addOAuthHeaders(&amp;$ch, $url, $oauthHeaders)
    {
      $_h = array('Expect:');
      $urlParts = parse_url($url);
      $oauth = 'Authorization: OAuth realm="' . $urlParts['path'] . '",';
      foreach($oauthHeaders as $name =&gt; $value)
      {
        $oauth .= "{$name}=\"{$value}\",";
      }
      $_h[] = substr($oauth, 0, -1);
  
      curl_setopt($ch, CURLOPT_HTTPHEADER, $_h); 
    }
  
    protected function generateNonce()
    {
      if(isset($this-&gt;nonce)) // for unit testing
        return $this-&gt;nonce;
  
      return md5(uniqid(rand(), true));
    }
  
    protected function generateSignature($method = null, $url = null, $params = null)
    {
      if(empty($method) || empty($url))
        return false;
  
  
      // concatenating
      $concatenatedParams = '';
      foreach($params as $k =&gt; $v)
      {
        $v = $this-&gt;encode($v);
        $concatenatedParams .= "{$k}={$v}&amp;";
      }
      $concatenatedParams = $this-&gt;encode(substr($concatenatedParams, 0, -1));
  
      // normalize url
      $normalizedUrl = $this-&gt;encode($this-&gt;normalizeUrl($url));
      $method = $this-&gt;encode($method); // don't need this but why not?
  
      $signatureBaseString = "{$method}&amp;{$normalizedUrl}&amp;{$concatenatedParams}";
      return $this-&gt;signString($signatureBaseString);
    }
  
    protected function httpGet($url, $params = null)
    {
      if(count($params['request']) &gt; 0)
      {
        $url .= '?';
        foreach($params['request'] as $k =&gt; $v)
        {
          $url .= "{$k}={$v}&amp;";
        }
        $url = substr($url, 0, -1);
      }
      $ch = curl_init($url);
      $this-&gt;addOAuthHeaders($ch, $url, $params['oauth']);
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
      $resp  = $this-&gt;curl-&gt;addCurl($ch);
  
      return $resp;
    }
  
    protected function httpPost($url, $params = null)
    {
      $ch = curl_init($url);
      $this-&gt;addOAuthHeaders($ch, $url, $params['oauth']);
      curl_setopt($ch, CURLOPT_POST, 1);
      curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params['request']));
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
      $resp  = $this-&gt;curl-&gt;addCurl($ch);
      return $resp;
    }
  
    protected function normalizeUrl($url = null)
    {
      $urlParts = parse_url($url);
      $scheme = strtolower($urlParts['scheme']);
      $host   = strtolower($urlParts['host']);
      $port = intval($urlParts['port']);
  
      $retval = "{$scheme}://{$host}";
      if($port &gt; 0 &amp;&amp; ($scheme === 'http' &amp;&amp; $port !== 80) || ($scheme === 'https' &amp;&amp; $port !== 443))
      {
        $retval .= ":{$port}";
      }
      $retval .= $urlParts['path'];
      if(!empty($urlParts['query']))
      {
        $retval .= "?{$urlParts['query']}";
      }
  
      return $retval;
    }
  
    protected function prepareParameters($method = null, $url = null, $params = null)
    {
      if(empty($method) || empty($url))
        return false;
  
      $oauth['oauth_consumer_key'] = $this-&gt;consumerKey;
      $oauth['oauth_token'] = $this-&gt;token;
      $oauth['oauth_nonce'] = $this-&gt;generateNonce();
      $oauth['oauth_timestamp'] = !isset($this-&gt;timestamp) ? time() : $this-&gt;timestamp; // for unit test
      $oauth['oauth_signature_method'] = $this-&gt;signatureMethod;
      $oauth['oauth_version'] = $this-&gt;version;
  
      // encoding
      array_walk($oauth, array($this, 'encode'));
      if(is_array($params))
        array_walk($params, array($this, 'encode'));
      $encodedParams = array_merge($oauth, (array)$params);
  
      // sorting
      ksort($encodedParams);
  
      // signing
      $oauth['oauth_signature'] = $this-&gt;encode($this-&gt;generateSignature($method, $url, $encodedParams));
      return array('request' =&gt; $params, 'oauth' =&gt; $oauth);
    }
  
    protected function signString($string = null)
    {
      $retval = false;
      switch($this-&gt;signatureMethod)
      {
        case 'HMAC-SHA1':
          $key = $this-&gt;encode($this-&gt;consumerSecret) . '&amp;' . $this-&gt;encode($this-&gt;tokenSecret);
          $retval = base64_encode(hash_hmac('sha1', $string, $key, true));
          break;
      }
  
      return $retval;
    }
  
    public function __construct($consumerKey, $consumerSecret, $signatureMethod='HMAC-SHA1')
    {
      $this-&gt;consumerKey = $consumerKey;
      $this-&gt;consumerSecret = $consumerSecret;
      $this-&gt;signatureMethod = $signatureMethod;
      $this-&gt;curl = EpiCurl::getInstance();
    }
  }
  
  class EpiOAuthResponse
  {
    private $__resp;
  
    public function __construct($resp)
    {
      $this-&gt;__resp = $resp;
    }
  
    public function __get($name)
    {
      if($this-&gt;__resp-&gt;code &lt; 200 || $this-&gt;__resp-&gt;code &gt; 299)
        return false;
  
      parse_str($this-&gt;__resp-&gt;data, $result);
      foreach($result as $k =&gt; $v)
      {
        $this-&gt;$k = $v;
      }
  
      return $result[$name];
    }
  }
  </code></pre>