OAuth

#Overview

This application uses three legged OAuth, which allows users to log in with their regular wiki account. When being logged in users can modify coordinates instantly, and the modifications made by them will be linked to their wiki account.

There are, not surprisingly, three steps involved in the three legged authorization process.

#Step 1

To begin with, the application needs to retrieve a temporary key that will be used in step 2. This is done through the URL <wiki-site>/w/index.php?title=Special:OAuth/initiate

#Step 2

Now the user will be sent to Wikipedia to log in with their Wiki account. The temporary key obtained in step 1 and the consumer key must be sent with the request. The full URL should be <wiki-site>/w/index.phptitle=Special:OAuth/authorize&oauth_token="<keyFromStep1>"&oauth_consumer_key="<consumerKey>"

#Step 3

The user is now redirected to the registered callback URL of the OAuth consumer (see Wiki page for OAuth consumers for more details). More specifically, the Wiki server makes a GET request to the callback URL, and in the get request there will be a parameter called oauth_verifier.

The temporary token (both the key and secret) obtained in step 1 and the oauth_verifier token must now be exchanged for an access token in order to complete the authorization process.

To exchange the tokens this URL should be used: <wiki-site>/w/index.phptitle=Special:OAuth/token

#Now what?

Now when MediaWiki's Action API is called, all actions performed by the API such as editing or creating pages, will be linked to the user's Wiki account.