I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites.
My application can post to Twitter on behalf of a user. This required implementing the OAuth 1.0a specification, as documented by Twitter.
All API endpoints on my site require authentication (I'm using JWTs). While implementing the OAuth 1.0a, I had to leave the callback URL from step 2 of the linked documentation open to anyone. Since the request comes from Twitter's servers, the Authorization header does not include my JWT.
The only HTTP method implemented on the callback URL is an HTTP GET. It's setup using django-rest-framework, and simply checks that the query parameters in the callback URL match values from my database.
I think this is okay from a security standpoint, but am I wrong?