Not able to get Authorization Code from URL in Chrome Custom Tabs oAuth2.0

[pyus13]

Hi,

I have just started the oAuth2.0 migration for fitbit integration but I am stuck on reading the authorization code from Callback URL in Google Chrome or Chrome Custom Tabs, as they did not give and intermediate navigaton urls in callbacks.

I tried with deep linking but seems not working most of the times and on some devices it never navigate use to the registered activity untill unless use reloads the page. Too much inconsistency in chrome tabs and chrome behaviours.

There are so many queries on stackoverflow and not getting any response from either fitbit or Google thats why I am here. Hope I will get a quick response here from fitbit developers.

Issue reported aon Google forums

https://code.google.com/p/chromium/issues/detail?id=543542

on Stackoverflow

http://stackoverflow.com/questions/33814946/android-chrome-custom-tabs-fitbit-web-api-wont-redirect-...

Please Help.

[JeremiahFitbit]

Perhaps app switch to the Android browser (Chrome or otherwise) instead of using the Chrome tab.

Your callback URI should be a deep link back to your app.

[pyus13]

I have already tried doing this but whats happening is its not navigating to the activity. 

My Call back url is https://mysite.com/callback and when I am redirected to the page, I am end up with an error "Webpage not avalable" when I press on reload it opens up the activity and I am able to get the code.

But its really a workaround and very bad experience for user more worst is sometimes even after reload it doesn't navigate to the activity so I tried "open in chrome" options from overflow menu and there also same "Webpage not available" and after clicking on reload it actually navigates to the activity that also works sometimes.

I have tested it on LG G3 and Moto X2 with latest chrome installed.

Vey incosistent and confusing behaviour.

[JeremiahFitbit]

If you're getting an error loading https://mysite.com/callback , then it sounds like either an issue with your callback URL or with Android.

[pyus13]

Hi,

When I tried Chrome/Default browser insted of Chrome Custom tabs, it pop ups the chosser dialog with all brower and my activity as an oprions in the list.

Now how can one be sure that user will select the right choice. Also if user is once authorized the pop also stops coming and no way to navigate to activity, the page remains open in chrome itself .

Thanks

[pyus13]

The call back URL is not any exixting website just a dummy url to get to know we got the authorization code on the mobile client side.

[JeremiahFitbit · Accepted solution]

The sandboxing of the Chrome tab is an intentional design by Google and why Fitbit permits its use. Your app shouldn't be able to interact with web browser, as doing so would allow an app to do malicious things.

In Andriod, you need to setup an App Intent and set your callback URL to be your app's defined URI schema. This is sometimes called a "deep link".

[pyus13]

Hi Jeremiah,

I did exactly same what you mentioned, deep linked the URL.

AFAIK, there are two issues associated with deep linking

1) It shows a pop up dialog where users needs to select how they want to navigate ?

2) If already authorized, not navigating to activity any how.

Code snippet :

My activity registered in manifest

 <activity
      android:name=".net.GetCodeFromUrl"
      android:label="@string/title_activity_get_code_from_url"
      android:theme="@style/MyAlertDialogStyle">
      <!-- ATTENTION: This intent was auto-generated. Follow instructions at
https://g.co/AppIndexing/AndroidStudio to publish your Android app deep links. -->
      <intent-filter>
          <action android:name="android.intent.action.VIEW"/>
          <category android:name="android.intent.category.DEFAULT"/>
          <category android:name="android.intent.category.BROWSABLE"/>
          <data
              android:host="mysite.com"
              android:pathPrefix="/"
              android:scheme="https"/>
      </intent-filter>
  </activity>

Code forcing to open URL using Chrome, No Chrome Tabs as you suggested because with chrome tabs nothing is working.

Intent intent=new Intent(Intent.ACTION_VIEW, Uri.parse(client.getAuthorizationURI()));
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
intent.setPackage("com.android.chrome");
try {
    startActivity(intent);
} catch (ActivityNotFoundException ex) {
    // Chrome browser presumably not installed so allow user to choose instead
    intent.setPackage(null);
    startActivity(intent);
}

Could you please give me any app reference which have successfully implemented oAuth2 as of now , It will give me the confidence and idea that things are working fine from the API level.

If you want I can give you the framework code I have developed to look in to, It is not working as you are expecting with implementation the API docs has suggested.

[pyus13]

Hi Jeremiah,

Finally with the "prompt = consent", I am able to navigate to the activity each time a call back url is loaded in Chrome Custom tabs but unfortunately ended with another problem.

I have flow like Activity A starts the Custom Chrome tab. And ActivityB is deeplinked with callback URL.

I have a local BroadCastreceiver setup which intimate ActivityA about the successful receipt of access_token which is broadcasted by ActivityB.

Now I am finishing the ActivityB as soon I receive the accesstoken and at the same time sending a broadcast to activity A so that it can come to front again. I am bringing ActivityA in front with below code

Intent intent = new Intent(this, MainActivity.class);
intent.addFlags(Intent.FLAG_ACTIVITY_REORDER_TO_FRONT);
startActivity(intent);

Now the issue is when user click a back button here on ActivityA the chrome tab is still opened and comes in front but application is closed already as ActivityA is my MainActity. Now if user will click Allow again on opened tab the deeplinked activity will open again and everything will be messed up.

There is no way I found to close that custom chrome tab form java, is there any way you can suggest ?

[graemeharnish]

I'm struggling with this as well.  Is there a sample on how to achieve this?

Thanks.

[graemeharnish]

Nevermind, after some fiddling, I got it to work.

[h2hjastermereel]

Could you explain what you did?

[scoleman2272]

I second that. I'm stuck here too!

[schristian]

Why don't you just provide a single working app with oAuth 2.0? I am very disappointed with documentation. I can't even authorize right now. 

[Brainuso]

Hi can I see your code and how you got the redirect Uri and access token? I've been stung here but no solution. Thanks. 

[DavidSFitbit]

@Brainuso you are the one that should be providing the redirect URI. The redirect URI should be the entry point for your application or integration. Fitbit will redirect users who have consented to your redirect URI along with either the access token or a code that you'll exchange for an access token.

You can more easily see how the different OAuth 2.0 flows are supposed to work on the OAuth 2.0 Tutorial.

[Brainuso]

I've provided the redirect URL already. I've gone through the work
tutorial. My challenge is the code to push the access token from the chrome
custom tabs to the application after the user login.