Twitter sign in module session token values lost in twitter/oauth path in HTTPS - Invalid Twitter OAuth request The twitter sign in module works on my local and staging server on HTTP fine. But when I install the same module in production mode which is https://example.com, it stops working. The error says "Invalid Twitter OAuth request". I debugged the code a little bit, and I could understand that the session variables stored in token before redirecting to twitter are lost when control is redirected to my site in twitter/oauth path.


/**
 * Submit handler for Twitter signin.
 */
function twitter_signin_redirect() {
  module_load_include('inc', 'twitter');
  $key = variable_get('twitter_consumer_key', '');
  $secret = variable_get('twitter_consumer_secret', '');
  $twitter = new Twitter($key, $secret);
  $token = $twitter->get_request_token();
  $_SESSION['twitter_oauth']['token'] = $token;
  $_SESSION['twitter_oauth']['destination'] = $_SERVER['HTTP_REFERER'];
  $_SESSION['twitter_oauth']['signin'] = TRUE;
  watchdog("twitter_sign_in", "Session Values Set => ". print_r($_SESSION, 1));
  drupal_goto($twitter->get_authenticate_url($token));
}


And on the validate function in twitter.pages.inc, the session values are clearly lost. I used watchdog entries on both functions. Its working fine in my local and staging server.


/**
 * Validate results from Twitter OAuth return request.
 */
function twitter_oauth_callback_form_validate($form, &amp;$form_state) {
  global $twitter_token;
  $key = variable_get('twitter_consumer_key', '');
  $secret = variable_get('twitter_consumer_secret', '');
  watchdog("twitter_sign_in", "Session Values Set => ". print_r($_SESSION, 1));

if (isset($_SESSION['twitter_oauth'])) {
    $form_state['twitter_oauth'] = $_SESSION['twitter_oauth'];
    unset($_SESSION['twitter_oauth']);
  }
  else {
    form_set_error('oauth_token', 'Invalid Twitter OAuth request');
  }


Any help appreciated. Thanks.
The error could be related to:


Using API on the wrong domain/subdomain (www prefix can be relevant).

See: Why do I get a Oauth error?
Temporary Twitter issue.

See: Twitter module Oauth &#39;TwitterException&#39; with message &#39;Unauthorized&#39;
Make sure your code is passing the valid oauth_verifier.


  For OAuth 1.0a compliance this parameter is required unless you are using xAuth. Currently Twitter supports both OAuth 1.0 and OAuth 1.0a which means we do not error if this value isn't included. It is strongly recommended that applications not using this parameter are immediately updated with support for oauth_verifier added. OAuth 1.0a will be enforced soon and applications not using the oauth_verifier will fail to complete the OAuth flow.


See: Oauth/access_token Stopped working today
Your Twitter module may be outdated, please consider upgrading it.


If it's still happening, check the logs for any detailed responses. Otherwise contact Twitter support.