HTTPS required starting Monday, Nov 3, 2014

[JeremiahFitbit]

This is a 90 day notice of a potentially breaking change.

On Monday, November 3, 2014, connections to api.fitbit.com will be restricted to HTTPS connections only. TLS ("SSL") will be required to use all api.fitbit.com endpoints, including all steps of OAuth.

TLS creates a secure communication channel between your application and Fitbit's API. If your application uses plaintext HTTP connections to access the Fitbit API, you need to update it to use HTTPS immediately.

For most applications, changing "http://" to "https://" on requests to api.fitbit.com and redirects to www.fitbit.com is all that is necessary to comply with this requirement.

The Fitbit API will return a HTTP 400 or 403 error to all non-HTTPS requests starting on November 3, 2014.

A "blackout test" will be performed on Tuesday, October 7, 2014, between 8–9 AM PDT. Non-HTTPS requests will fail for a brief period of time. This time will be announced here and at https://status.fitbit.com/ .

If you have questions about securely connecting to https://api.fitbit.com, please post them here.

[bigrice]

Thank you very much for your help. However it looks like I still get an error message:
Can't open perl script "/usr/local/cpanel/3rdparty/quickinstall/scripts/checkupdates.pl": Permission denied

Any additional help would be much appreciated
Lan

[ibahdanau]

Hello,

Seems this it nothing has to do with Fitbit API.

P.S.

In general error you're seeng is most likely file permissions related.

Make sure that when you run

ls -l /usr/local/cpanel/3rdparty/quickinstall/scripts/checkupdates.pl

it has proper permissions set to this file.

[bigrice]

Thank you for your prompt reply. I will work with my hosting company tomorrow to see what's going on. Thank you

[aditya14641]

I am getting following message after pasting the fitbit consumer key into the mentioned tool for https check :

What is interpretation of this message (what does "this time period mean"?) ?

When will Fitbit run the next check round for http/https ? I want to see latest status of my app

Non-HTTPS requests to the Fitbit API between 2014-10-17 15:00:00 and 2014-10-17 15:30:00 UTC:

• Only HTTPS requests found during this time period.

[SunsetRunner]

---

@aditya14641 wrote:

I am getting following message after pasting the fitbit consumer key into the mentioned tool for https check :

What is interpretation of this message (what does "this time period mean"?) ?

When will Fitbit run the next check round for http/https ? I want to see latest status of my app

Non-HTTPS requests to the Fitbit API between 2014-10-17 15:00:00 and 2014-10-17 15:30:00 UTC:

• Only HTTPS requests found during this time period.

---

> What is interpretation of this message (what does "this time period mean"?) ?

It means that in between 2014-10-17 15:00:00 and 2014-10-17 15:30:00 UTC, there were 0 non-HTTPS requests made by your application.

Private message me your consumer key and I'll be happy to check the latest status for you.

In general, if you have verified that your app connects to https://api.fitbit.com and not http://, then you should be in good shape.

[aditya14641]

PM'ed you the keys

[aditya14641]

I want to know the recent status of my API (whether its making http or https calls).

Can anyone help me with this ?

I can PM the keys.

Thanks in advance

[invictvs]

Hi,

I was using the Java API Client example and I updated my fitbit.properties to:

fitbitSiteBaseUrl=https://www.fitbit.com
apiBaseUrl=api.fitbit.com
baseUrl=https://localhost:8443/redacted

clientConsumerKey=redacted
clientSecret=redacted

I have created a self-signed SSL for tomcat to support https requests and I have verified the request is being sent to fitbit as HTTPS but I am still getting a 400 (not for /authorize or the callback /completeAuthorization, but any other call throws it). I have also updated the callback url and app website to reflect this. I am not sure why I can't make the calls, please help.

Thanks, if you have any questions let me know.

[lamia]

Hey everyone,

I changed the needed changes http:// to https://

fitbitSiteBaseUrl=https://www.fitbit.com
apiBaseUrl=api.fitbit.com

But it doesn't work.

I get this error message:

Exception in thread "main" com.fitbit.api.FitbitAPIException: Error getting user info: com.fitbit.api.FitbitAPIException: 400: The request was invalid. An accompanying error message will explain why.
{"errors":[{"errorType":"request","fieldName":"n/a","message":"This request should use https protocol."}],"success":false}

What shall I do?

(I use fitbit4j)

Thanks in advance

Lamia

[ibahdanau]

One thing you can do is try to compile Fitbitj4 from github:
https://github.com/Fitbit/fitbit4j/blob/master/fitbit4j/

it already should have updated version with https everywhere.

If you prefer to stay with Fitbit4j version that you currently using you have to update FitbitApiClientAgent.getApiBaseUrl() method and recompile ther class. 

After recompiling and redeploying your project it should start working cirrectly.

[iambahar]

Hi,

I am using https://github.com/heyitspavel/fitbitphp library and using https.

Everything works great except in addSubsction method (https://github.com/heyitspavel/fitbitphp/blob/master/fitbitphp.php#L2168) I am receiving an error where it says that I need to use https.

But I am already using https and authentication, getSteps methods are already working.

Can you please check and help me?

Thanks,

[john_smith]

Hi there,

I've changed the mentioned parameters i.e.

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = true)

and

private function initUrls($https = true, $httpsApi = true)

as well as private $authHost = 'https://www.fitbit.com'; and private $apiHost = 'https://api.fitbit.com';

When I run the API page then each time I got this error message i.e.

Fatal error: Uncaught exception 'OAuthException' with message 'making the request failed (Couldn't resolve host name)' in C:\wamp\www\healthstatus\wp-content\themes\healthstatus\fitbitphp.php on line 187( ! ) OAuthException: making the request failed (Couldn't resolve host name) in C:\wamp\www\healthstatus\wp-content\themes\healthstatus\fitbitphp.php on line 187

See this screenshot http://prntscr.com/538dju

Some times the error says

Fatal error: Uncaught exception 'OAuthException' with message 'making the request failed (Peer certificate cannot be authenticated with given CA certificates)' in C:\wamp\www\healthstatus\wp-content\themes\healthstatus\fitbitphp.php on line 187
 
( ! ) OAuthException: making the request failed (Peer certificate cannot be authenticated with given CA certificates) in C:\wamp\www\healthstatus\wp-content\themes\healthstatus\fitbitphp.php on line 187

http://prntscr.com/538ett

Can you please look into this?

It stops working after 3 nov 2014

Thanks

John

[todwith1d]

We have updated the .Net code to use https on all URLs from your .net FitbitAPI_dotNET_Client.  

The https test site returned this (which was correct at the time):

Non-HTTPS requests to the Fitbit API between 2014-10-17 15:00:00 and 2014-10-17 15:30:00 UTC:

• Only HTTPS requests found during this time period.

The only place we are NOT using https is in our hosted app URL.  Does that have to be https as well ?

Here is the exception xml:

<?xml version="1.0" encoding="UTF-8"?>

<result>

<errors>

<apiError>

<errorType>request</errorType>

<fieldName>n/a</fieldName>

<message>This request should use https protocol.</message>

</apiError>

</errors>

<success>false</success>

</result>

Thanks for any help

Tod 

[ibahdanau]

---

@todwith1d wrote:

We have updated the .Net code to use https on all URLs from your .net FitbitAPI_dotNET_Client.  

The https test site returned this (which was correct at the time):

Non-HTTPS requests to the Fitbit API between 2014-10-17 15:00:00 and 2014-10-17 15:30:00 UTC:

• Only HTTPS requests found during this time period.

The only place we are NOT using https is in our hosted app URL.  Does that have to be https as well ?

Here is the exception xml:

<?xml version="1.0" encoding="UTF-8"?>

<result>

<errors>

<apiError>

<errorType>request</errorType>

<fieldName>n/a</fieldName>

<message>This request should use https protocol.</message>

</apiError>

</errors>

<success>false</success>

</result>

Thanks for any help

Tod 

---

What API request returns to you this response.

The basic rule is: every single request that is made to api.fitbit.com should be made over https.

[JeremiahFitbit]

---

@todwith1d wrote:

The only place we are NOT using https is in our hosted app URL.  Does that have to be https as well ?

---

Your application does not need be hosted using HTTPS (but it's a great thing to do). Only requests to api.fitbit.com and redirects to www.fitbit.com as part of OAuth 1.0a are required to use HTTPS.

[john_smith]

Hi,

I am working on Fitbit API and it stops working form 3 nov 2014. As per "DCHEN" reply i.e.

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = false)

To:

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = true)

Change:

private function initUrls($https = true, $httpsApi = false)

To:

private function initUrls($https = true, $httpsApi = true)

I did the same but its not working yet, still I am getting this error message like this

Fatal error: Uncaught exception 'FitBitException' with message 'Fitbit request failed. Code: 400' in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

( ! ) FitBitException: Fitbit request failed. Code: 400 in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

Can you please look into this?

Its very urgent, thanks in advance...

Thanks

John

[john_smith]

Hi,

I am working on Fitbit API and it stops working form 3 nov 2014. As per "DCHEN" reply i.e.

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = false)

To:

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = true)

Change:

private function initUrls($https = true, $httpsApi = false)

To:

private function initUrls($https = true, $httpsApi = true)

I did the same but its not working yet, still I am getting this error message like this

Fatal error: Uncaught exception 'FitBitException' with message 'Fitbit request failed. Code: 400' in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

( ! ) FitBitException: Fitbit request failed. Code: 400 in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

Can you please look into this?

Its very urgent, thanks in advance...

Thanks

John

[ibahdanau]

Hello, my suggestion would be debug your code up to the step where you send the API request and check what http protocol you're using. 

[400: "This request should use https protocol." ] only returned for the cases when you're not using https.

There is not too much we can debug or see on our side. 

P.S. also based on your message I'm not 100% confident that it is https related, since you haven't mentioned you saw "This request should use https protocol." phrase as part of bad response body, even though I'm pretty sure it's related to https cause we did enable https requirement on Nov 3 2014 10:00am PT.

[iambahar]

Can you please reply to my earlier post regarding add subscription API method?

[ibahdanau]

The answer to your question is pretty similar to my previous post:

if you getting back message that you're not using https that means you're not using https protocol for that particular API request.

Other requests may work cause you DO use HTTPS for those.

[SunsetRunner]

---

@john_smith wrote:

Hi,

I am working on Fitbit API and it stops working form 3 nov 2014. As per "DCHEN" reply i.e.

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = false)

To:

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = true)

Change:

private function initUrls($https = true, $httpsApi = false)

To:

private function initUrls($https = true, $httpsApi = true)

I did the same but its not working yet, still I am getting this error message like this

Fatal error: Uncaught exception 'FitBitException' with message 'Fitbit request failed. Code: 400' in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

( ! ) FitBitException: Fitbit request failed. Code: 400 in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

Can you please look into this?

Its very urgent, thanks in advance...

Thanks

John

---

The FitbitPHP library was updated to use SSL by default and you should grab the latest copy from https://github.com/heyitspavel/fitbitphp

I don't see any reported issues on the Github repository about SSL issues but if you encounter any, just open up an issue there.

[SunsetRunner]

Hi,

I am working on Fitbit API and it stops working form 3 nov 2014. As per "DCHEN" reply i.e.

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = false)

To:

public function setEndpointBase($apiHost, $authHost, $https = true, $httpsApi = true)

Change:

private function initUrls($https = true, $httpsApi = false)

To:

private function initUrls($https = true, $httpsApi = true)

I did the same but its not working yet, still I am getting this error message like this

Fatal error: Uncaught exception 'FitBitException' with message 'Fitbit request failed. Code: 400' in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

( ! ) FitBitException: Fitbit request failed. Code: 400 in C:\wamp\www\fitbitphp-master\fitbitphp.php on line 325

Can you please look into this?

Its very urgent, thanks in advance...

Thanks

John