Any issues with authorization today ?

[tonybarry]

Hi Fitbit people,

My app has been working with oAuth 2.0 for some months.  Today (about two hours ago) I had the occasion to reauthorise a user to allow my app to read his data, but it did not work.

I do get a proper code fragment returned in the browser URL bar from the authorisation step (and delivered to my web component).

Unfortunately, the code fragment no longer works when I submit it to the POST at https://www.fitbit.com/oauth2/authorize?

"errors":[{"errorType":"invalid_request","message":"Redirect_uri mismatch: null. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false

This code was working a couple of days ago.

Are there any recent changes in this arena, or any API system components which are "down" just now ?

Regards,

Tony Barry

[tonybarry · Accepted solution]

Right. Fitbit tightened up on their input sanitising (which is good) but in the process my code died (which is bad) because I sent a malformed POST, with the header

"redirect_uri="    which should have been

"redirect_uri"

I also had my uri written as

"https%3A%2F%2Fwww.integ..." instead of 

"https://www.integ..."

which used to work but does no longer.

Hope this helps others.

Regards,

Tony Barry

[JeremiahFitbit]

Can you clarify the exact POST request you were making?

redirect_uri shouldn't be in the header, but body. Form parameter values must always been encoded.

[tonybarry · Accepted solution]

Hi Jeremiah,

Sure.  Here is the POST that worked, with the bits that failed in comments. Using cURL and a nice wrapper for Xojo, to make it easy for the unwashed masses like me to understand.

-----

dim c as new CURL

c.URL = "https://api.fitbit.com/oauth2/token"
c.verbose = true
c.ASynchronous = true
c.Method = c.kmethodPOST

dim authField as string
authField = "Basic " + EncodeBase64(inClientID + ":" + inClientSecret)
c.addHeader("Authorization", authField)

c.addData("client_id", inClientID)
c.addData("grant_type", "authorization_code")

dim redirectURI as string
//redirectURI = "https%3A%2F%2Fwww.integ..."
redirectURI = "https://www.integ..."

//c.addData("redirect_uri=", redirectURI)
c.addData("redirect_uri", redirectURI)

c.addData("code", inToken)

c.execute

-----

Regards,

Tony Barry

Sydney Australia

[JeremiahFitbit]

Thanks, @tonybarry. That makes more sense. I think most cURL libraries handle the parameter value assignment and URI/form encoding, so I think you're correct that double assignment characters and double encoded values were being sent. I'm surprised that ever worked!

[tonybarry]

Hi Jeremiah,

Yes, well it worked before. Very nicely.  

Now it's fixed I can go back to developing the rest of the app.

I am very pleased with oAuth2.0 ... much more civilised than v1.0, and with cURL verbose debugging, it is fairly informative when it fails.

Regards,

Tony Barry

Sydney, Australia