When Twitter decided to shut down their basic authentication service a few weeks ago, it provided the impetus I needed to start figuring out how to use OAuth. Dogan Berktas’s article and source code were a real godsend on this, but something bothered me about it:

(In LoginServlet.java:)

HttpSession session = request.getSession();
session.setAttribute("token", token);
session.setAttribute("tokenSecret", tokenSecret);

While it works fine, putting the secret tokens in the session makes me uneasy. I’ve reworked the code a bit to store the secret keys in GAE’s persistent datastore, instead. Here’s the result:

1. You’ll need to follow the setup instructions that Mr. Berktas lays out here: http://doganberktas.com/2010/01/26/using-twitter-oauth-on-gaej/

2. Add persistence support to your application (src/META-INF/persistence.xml):

<persistence xmlns="http://java.sun.com/xml/ns/persistence"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
        version="1.0">
   <persistence-unit name="mydata">
      <provider>org.datanucleus.store.appengine.jpa.DatastorePersistenceProvider</provider>
      <properties>
         <property name="datanucleus.NontransactionalRead" value="true" />
         <property name="datanucleus.NontransactionalWrite" value="true" />
         <property name="datanucleus.appengine.autoCreateDatastoreTxns" value="false"/>
         <property name="datanucleus.ConnectionURL" value="appengine" />
         <property name="datanucleus.jpa.addClassTransformer" value="false" />
      </properties>
  </persistence-unit>
</persistence>

3. Create an object which can store the request keys:

import javax.persistence.Entity;
import javax.persistence.Id;

@Entity
public class TwitterRequestToken {
	@Id
	private String requestTokenKey;

	private String requestTokenSecret;

	private long lastUsed;

	public String getRequestTokenKey() {
		return requestTokenKey;
	}

	public void setRequestTokenKey(String requestTokenKey) {
		this.requestTokenKey = requestTokenKey;
	}

	public String getRequestTokenSecret() {
		return requestTokenSecret;
	}

	public void setRequestTokenSecret(String requestTokenSecret) {
		this.requestTokenSecret = requestTokenSecret;
	}

	public long getLastUsed() {
		return lastUsed;
	}

	public void setLastUsed(long lastUsed) {
		this.lastUsed = lastUsed;
	}

}

4. Since the EnityManagerFactory is slow to create, and reusable in both servlets, you’ll need a singleton to create and manage it:

import javax.persistence.EntityManagerFactory;
import javax.persistence.Persistence;

public class SingletonEntityManagerFactory
{
	private static final EntityManagerFactory def = Persistence.createEntityManagerFactory( "mydata" );

	public static EntityManagerFactory getDefault()
	{
		return def;
	}
}

5. For convenience’s sake, I moved the Consumer Key and Consumer Secret (the ones Twitter gives you when you register your application) into static constants:

public class TwitterSettings {

	/**
	 * Twitter OAuth Consumer Key.
	 */
	public static final String CONSUMER_KEY = "<your consumer key here>";

	/**
	 * Twitter OAuth Consumer Secret.
	 */
	public static final String CONSUMER_SECRET = "<your consumer secret here>";
}

6. And at last, the updated servlets themselves:
LoginServlet.java:

import java.io.IOException;
import java.io.PrintWriter;

import javax.persistence.EntityManager;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import twitter4j.Twitter;
import twitter4j.TwitterException;
import twitter4j.TwitterFactory;
import twitter4j.http.RequestToken;

public class LoginServlet extends HttpServlet {
	private static final long serialVersionUID = 1L;

	public void doGet(HttpServletRequest request, HttpServletResponse response)
			throws IOException {
		try {
			Twitter twitter = new TwitterFactory().getInstance();
			twitter.setOAuthConsumer(TwitterSettings.CONSUMER_KEY,
					TwitterSettings.CONSUMER_SECRET);
			RequestToken requestToken = twitter.getOAuthRequestToken();

			storeToken( requestToken );

			PrintWriter out = response.getWriter();
			try {
				response.setContentType("text/html;charset=UTF-8");
				out.print("<a href='" + requestToken.getAuthorizationURL()
						+ "'/>Sign in with Twitter</a>");
			} finally {
				out.close();
			}
		} catch (TwitterException te) {
			if (401 == te.getStatusCode()) {
				System.out.println("Unable to get the access token.");
			} else {
				te.printStackTrace();
			}
		}
	}

	protected synchronized void storeToken(RequestToken requestToken)
	{
		EntityManager em = SingletonEntityManagerFactory.getDefault().createEntityManager();

		try {
			em.getTransaction().begin();

			TwitterRequestToken token = new TwitterRequestToken();
			token.setLastUsed( System.currentTimeMillis() );
			token.setRequestTokenKey( requestToken.getToken() );
			token.setRequestTokenSecret( requestToken.getTokenSecret() );

			em.persist( token );
		}
		catch( Exception e )
		{
			em.getTransaction().rollback();
		}
		finally
		{
			if( em.getTransaction().isActive() )
			{
				em.getTransaction().commit();
			}
		}
		em.close();
	}
}

HomeServlet.java:

import java.io.IOException;
import java.io.PrintWriter;

import javax.persistence.EntityManager;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import twitter4j.Twitter;
import twitter4j.TwitterException;
import twitter4j.TwitterFactory;
import twitter4j.User;
import twitter4j.http.AccessToken;

public class HomeServlet extends HttpServlet {
	private static final long serialVersionUID = 1L;

	public void doGet(HttpServletRequest req, HttpServletResponse resp)
			throws IOException {
		Twitter twitter = new TwitterFactory().getInstance();
		PrintWriter out = resp.getWriter();

		try {
			twitter.setOAuthConsumer( TwitterSettings.CONSUMER_KEY, TwitterSettings.CONSUMER_SECRET );

			EntityManager em = SingletonEntityManagerFactory.getDefault().createEntityManager();
			TwitterRequestToken requestToken = em.find( TwitterRequestToken.class, req.getParameter( "oauth_token" ));

			AccessToken accessToken = twitter.getOAuthAccessToken(
					requestToken.getRequestTokenKey(), requestToken.getRequestTokenSecret() );
			twitter.setOAuthAccessToken(accessToken);

			User user = twitter.verifyCredentials();

			HttpSession session = req.getSession();
			session.setAttribute("twitter-user", user);
			//
			try {
				resp.setContentType("text/html;charset=UTF-8");
				//
				out.println("hello " + user.getName() + " from "
						+ user.getLocation());
				out.println("Followers : " + user.getFollowersCount());
				out.println("Following : " + user.getFriendsCount());
				out.println("Status count : " + user.getStatusesCount());
			} finally {
				out.close();
			}
		} catch (TwitterException e) {

			e.printStackTrace();
		}
	}
}

7. I am, regrettably, leaving cleaning up the datastore as an exercise for the reader. Each request token in the datastore has a timestamp – you’ll need to check them over periodically and clear out the ones that haven’t been used in a while.