OAuth prompt parameter

[martinstreicher]

I want to force a login each time I call the Fitbit Oauth API. The documentation says the "prompt" parameter can be set to achieve different authorization behaviors. It looks like the setting "login" is what I want to use, but when I set prompt to that value, I do not see any difference. If I am logged into Fitbit, I stay logged in, and no login screen appears. 

I am using Ruby, Rails, Devise, and Omniauth, and have this set:

  config.omniauth :fitbit,
    Rails.configuration.x.fitbit_key,
    Rails.configuration.x.fitbit_secret,
    authorize_params: { prompt: 'login' }

Am I missing something? 

[martinstreicher]

If I use this code...

  config.omniauth :fitbit,
    Rails.configuration.x.fitbit_key,
    Rails.configuration.x.fitbit_secret,
    authorize_params: { prompt: 'consent', requestCredentials: 'true' }

... I can force the login screen. A PHP developer posted about the requestCredentials parameter. Why is it not documented? Is prompt a real parameter? 

[JeremiahFitbit]

'prompt' is the correct parameter and its values are documented here.

'requestCredentials' is not a valid Authorization Page parameter for Fitbit.

[martinstreicher]

I am almost certain that specifying authorize_params: { prompt: 'login'} did not change the behavior. Do you have a working code sample showing that it does? 

[JeremiahFitbit · Accepted solution]

I can't debug your code, but I can demonstrate this behavior.

Here is an authorization page for my demo app. It will redirect you to https://localhost/ after authorization, so look at your browser URL bar instead of expecting a page to load.

https://www.fitbit.com/oauth2/authorize?response_type=token&client_id=228YX6&redirect_uri=https%3A%2...

Every time I go to that URL, no matter how many times I've authorized the app, I will be signed out of fitbit.com, forced to sign in, and prompted (re) authorized the app.

[martinstreicher]

Thanks for the reply. I will check the params in the browser's request to login and make sure the prompt params is there. 

[chw333]

/usr/lib/python2.6/site-packages/requests/packages/urllib3/util/ssl_.py:120: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
InsecurePlatformWarning
Traceback (most recent call last):
File "test.py", line 92, in <module>
intradayH = authd_client.intraday_time_series('activities/heart', base_date = '2015-10-28', detail_level = '1sec', start_time = None , end_time = None )
File "/root/fitbit/fitbit/api.py", line 687, in intraday_time_series
return self.make_request(url)
File "/root/fitbit/fitbit/api.py", line 362, in make_request
response = self.client.make_request(*args, **kwargs)
File "/root/fitbit/fitbit/api.py", line 225, in make_request
raise exc
fitbit.exceptions.HTTPTooManyRequests: Rate limit exceeded for this user. Please try again at the start of the hour. More information about rate limiting is at <https://dev.fitbit.com/docs>.

[JeremiahFitbit]

That just means that you exceeded the rate limit.

[martinstreicher]

I am not sure what this has to do with Oauth. 

[JeremiahFitbit]

It doesn't. It looks like you were making a request to the activities/heart time series.