Twitter OAuth and WebApp (with Ember)

Question

Currently I am working on an WebApp with Ember.JS. Now I want my customers to log in with their Twitter account using OAuth but I don't want my App to reload when they do.

So my idea was to have the login button open an popup to the Twitter authentication page which redirects to my page which has some JS based on the result e.g

window.opener.success(userdata);

and

window.opener.failure(error);

But since it first redirects to Twitter (the popup) browsers remove the window.opener properties to prevent cross site scripting even though it does redirect back to my own domain (where the JS code is).

Is there another way to go about this?

edit: I could user postMessage, but this doesn't work in IE8/IE9 in a popup. Only in an iFrame.

Answer 1

Yes, you have the same idea as some other programmers at Vestorly; they made a social authentication plugin called Torii I would recommend this as they have probably also taken care of all your obvious security concerns.