Implicit Flow Request Issue

[Ehaver282]

Hello,

I am attempting to develop a PHP application that will allow users to connect with Fitbit and save their steps, activity, etc... on our system. I have everything working great until I attempt to do an implicit flow request instead of an authertication flow. I get the app authorization page and get redirect to the correct program but my url has a pound sign as the first character of the paramater string.

My redirect url is http://www.MyFitBitTest.com/FitBitData.php

One an implicit return I get

http://www.MyFitBitTest.com/FitBitData.php#scope=activity&state=F4IdPAUccSQI%252Bw%252F2ptk%252FiVdi...

The # is prevent me from reading the URL string to get the parameters I need.

Again when I run a request using response_type=code instead of token everything works fine.

I would really like to use the implicit flow to set a longer expiration date for our tokens.

Has anyone had this issue? Is this a bug in FitBit's redirect?

Thank you,

Ernie

[SunsetRunner · Accepted solution]

If you have a server-side application, you should consider using the authorization code flow, its meant for this. Using the auth code flow, you don't need to worry about having the users re-authenticate after 30 days. Your app will get an access token and refresh token. While the access token expires after 1 hour, the refresh token doesn't expire and you can use that refresh token to obtain a new access token and new refresh token. (A refresh token expires after its used but you get a new refresh token as part of that process)

To answer your question, you will need to use Javascript in the user's browser to read the scope, state, and access token. The implicit grant flow is intended for client-side only applications and this behavior is expected.