Authentication Permissions unable to be set with Mobile Chromium Browsers.

[Drasiel]

I've been fighting with this off and on for a couple of days but I just figured out what the problem was. If I open the Fitbit authorization link with an Android Chromium-based browser (ie., Google Chrome, Vivaldi, etc) the page will not submit the data. This only occurs specifically with mobile Chromium browsers, the desktop versions and mobile Firefox are not affected. I have only tested this with OAUTH2.0 application-type personal using the Implicit Grant Flow. I do not know enough about this to know if the issue could be due to the redirect URI and I don't have another one to test with so I cannot check that. 

Reproduction:

example of the link used
<https://www.fitbit.com/oauth2/authorize?response_type=code&client_id=#####&redirect_url=https://tasker.joaoapps.com/auth.html&prompt=login&scope=activity+cardio_fitness+electrocardiogram+heartrate+location+nutrition+oxygen_saturation+profile+respiratory_rate+settings+sleep+social+temperature+weight>

if you want to set up your own version of that link to test with here are the Fitbit register an app form items:

Spoiler

Application name: Tasker
Description: Pull Fitbit Data for Tasker
Application Website URL:  https://tasker.joaoapps.com/
Organization Website URL: https://tasker.joaoapps.com/
Terms of Service URL: https://tasker.joaoapps.com/
Privacy Policy URL: https://tasker.joaoapps.com/privacy.html
OAuth Application Type: personal
Redirect URL: https://tasker.joaoapps.com/auth.html
Default Access Type: Read & Write

1. Copy the link into the mobile Chromium Browser address bar and hit confirm. (currently tested with Google Chrome and Vivaldi).
2. Tick any or all permissions.
3. Click accept.
4. The page may try to redirect and exit the browser. 
   
   1. If you happen to have Tasker installed it may open it.
5. Go back to the browser and find the tab you just left.
6. You will see that you are back on the select permissions screen instead of having been routed to your redirect URI.

[GordonFitbit]

Hi @Drasiel 

When implementing the authorization flow, are you using custom tabs on Android or a webview?

Gordon

[Drasiel]

Neither. I was using the mobile browser. I had a lot of issues with authentication through the HTTP response get/post (still trying to figure out a way to send checkbox info through the HTTP Post body properly to avoid this whole issue) and the inbuilt HTTP Auth method just opens your web browser, not a webview or custom tab. Since I didn't pay for the plugin that lets you use webview I couldn't even use it with the HTTP response get/post. So I cut out the middlemen and was using the actual mobile browser directly to travel to that link to figure out what was going wrong.