ColdFusion 11, Using <cfoauth> with FitBit

[cmiles74]

I'm working with a client that's pretty invested in ColdFusion and I'm attempting to integrate their webapp with FitBit. I have successfully used ColdFusion 11 and the built-in <cfoauth> function to integrate with FaceBook and am trying to do the same with FitBit. Unfortunately, it is not as straightforward as I had hoped.

My code is similar to the code below:

<cfoauth clientid="******"         
         secretkey="*******************"
         state="fb"
         result="r"
         scope="activity profile"
         redirecturi="https://miiawinners.org/fitbit/index.cfm"          
         authendpoint="https://www.fitbit.com/oauth2/authorize"
         accesstokenendpoint="https://www.fitbit.com/oauth2/token">
<cfset Session.fbinfo = #r#>
<cflocation url="result.cfm">

This would be on the test page, right now that's called "index.cfm". When FitBit posts back to this page, I'm seeing the following error.

The following information is meant for the website developer for debugging purposes.

Error Occurred While Processing Request
Failure! Ensure that you have provided valid data for attributes.

Browser   	Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Remote Address   	50.250.16.1
Referrer   	https://www.fitbit.com/oauth2/authorize?client_id=******&redirect_uri=https://miiawinners.org/fitbit/index.cfm&scope=activity%20profile&state=fb&response_type=code
Date/Time   	07-Sep-16 11:50 AM

It looks like I successfully authorize with FitBit and FitBit posts back, but the ColdFusion <cfoauth> function has trouble understanding the results.

Does anyone know if this works? I wonder, since the Google and Facebook authentication is somehow baked into this function.

Also, does the "authendpoint" and "accesstokenendpoint" look correct? For Google and Facebook authentication, these fields aren't needed.

Any help you might be able to provide would be greatly appreciated! 🙂

[JeremiahFitbit]

It's going to be difficult for us to debug your code, because the error message you shared is specific to your app and not something we're familiar with. However, we can debug the actual HTTP requests very well if you can capture and share those.

It sounds like the user is able to get to the authorization consent page and click 'allow' and be redirected back to your application, but your application is failing to exchange the 'code' for an access token as part of the Access Token Request. Is what I described correct? If so, can you capture the HTTP request being made for the Access Token Request and the response?

(Minor detail: the 'b' in Fitbit is not capitalized.)

[cmiles74 · Accepted solution]

Thank you for your reply. 🙂

I am not sure how much time I want to spend on this, as I don't work directly for Adobe. ColdFusion 11 includes this <cfoauth> tag, it's not code that I wrote or have access to. My hope was that I'd get a categorical "this doesn't work" response and I could then log a bug with Adobe.

Late yesterday I manually coded up the authorization and token request and it works well enough. It's a little more code that the <cfoauth> tag, but it's working.

I understand that you don't work for Adobe either and it's certainly not your responsibilty to test against their apparently weak and lame OAuth2 implementation. For now, I think the solution is to simply not use the <cfoauth> function unless it's with one of the clearly supported services (at this time, I think that's just Google and Facebook).

[JeremiahFitbit]

Interesting. I wish I knew more to help Coldfusion users. Please let me know if you find anything. Fitbit's Authorization Code Grant flow should be identical in process to Google's. (Facebook's is so incompatible with the RFC that it can't even call its flow OAuth anymore.)