A simple Twitter OAuth proxy.
What is Mooch?
Mooch is a simple app designed to allow unauthenticated access to the Twitter API for web apps that have no server-side components. Mooch is designed to be deployed as a Heroku app, which makes deployment of a new Mooch service extremely simple.
Why is this necessary?
In June 2013, Twitter officially retired version 1.0 of their API. Since version 1.1 of the Twitter API requires OAuth authentication for every request, this effectively meant the end of client-side only, unauthenticated Twitter applications.
This is still the case. It is still impossible to write a secure, client-side only application that uses the Twitter API without forcing users to log in via Twitter, even for information that is publicly available without authentication from the Twitter website. That's where Mooch comes in.
Mooch is the simplest possible server-side component for creating primarily client-side Twitter applications.
Demo Mooch service
Step 1: Create a Twitter app
Step 2: Get Mooch
- Clone the Git repository (
git clone email@example.com:eloquent/mooch.git).
- Change into the Mooch root directory.
- Check out the master branch (
git checkout master).
Step 3: Create a Heroku app
- Sign in with Heroku Toolbelt (
- Create a new app with
Step 4: Configuration
Step 4.1: Set up OAuth credentials
Variables: MOOCH_CONSUMER_KEY and MOOCH_CONSUMER_SECRET.
Example authentication configuration
heroku config:set MOOCH_CONSUMER_KEY=xvz1evFS4wEEPTGEFPHBog heroku config:set MOOCH_CONSUMER_SECRET=L8qq9PZyRg6ieKGEKhZolGC0vJWLw8iEJ88DRdyOg
Step 4.2: (optional): Set up allowed and forbidden paths
Variables: MOOCH_ALLOW and MOOCH_DENY.
By default Mooch allows access to any part of the Twitter API. This is not always ideal as anyone could find and use the service for their own requirements, potentially contributing to the Twitter application being rate limited.
Mooch uses a simple 'whitelist' (MOOCH_ALLOW) and 'blacklist' (MOOCH_DENY) of regular expressions to restrict access. Any incoming request that is disallowed will be immediately sent a HTTP 403 response with an imitation Twitter API error response as the body.
Mooch first tries to find a matching 'allow' pattern for the request. If none of the patterns match, the request is denied. Mooch then tries to find a matching 'deny' pattern for the request. If any of the patterns match, the request is denied.
Example access control configuration
This configuration would allow access to any user's timeline or statuses, with the exclusion of Justin Bieber.
heroku config:set MOOCH_ALLOW='["^/1\\.1/statuses/user_timeline\\.json","^/1\\.1/statuses/show\\.json"]' heroku config:set MOOCH_DENY='["\\bscreen_name=justinbieber\\b"]'
Step 5: Deploy
git push heroku master
The new Mooch service should now be ready for use. Check the Heroku dashboard for the service's location.
Mooch can be started locally using
npm start, but it requires some
environment variables to be present. Fortunately it is possible to do all of
this in a single line (at least in bash):
MOOCH_CONSUMER_KEY=xvz1evFS4wEEPTGEFPHBog MOOCH_CONSUMER_SECRET=L8qq9PZyRg6ieKGEKhZolGC0vJWLw8iEJ88DRdyOg npm start