OAuth2 Authorisation returning 403 Forbidden

[DaveB222]

Does anyone know if the Authorization flow has changed recently?

We have suddenly been getting '403 - Forbidden' when loading the authorisation page using the following URL (edited):

https://www.fitbit.com/oauth2/authorize?client_id=123456&response_type=code&redirect_uri=https%3A%2F...

We have 3 different redirect URI's defined in our App settings, not sure if that is the issue, when I try to edit our App Settings to define only one I get another 403 - Forbidden error.

The last successful connection was 26 June 24 so something must have changed since then

[Gordon-C]

Hi @DaveB222 

To my knowledge, the authorization flow has not changed.   Are you still receiving the 403 errors now?   If so, let me know.   I would like to reach out to you directly to get more information from you.

[DaveB222]

Hi @Gordon-C ,

Thanks for the follow up, to provide a bit more info...

Up until recently we were providing a 'redirect_uri' query parameter in the authorise url, but I noticed that this is no longer mentioned in the documentation so I assume it has been removed at some point?

When I remove the redirect_uri from the authorize URL I no longer get a 403 and the authorisation page loads ok but I get an error after entering my fitbit credentials : "Developer information: invalid_request - Missing redirect_uri parameter value"

I am assuming that the redirect_uri is now read directly from our App Settings? But because we have multiple URL's defined it's throwing this error? Since we support a mobile app, mobile website and desktop website we need to have a few redirect_uri options

I've not been able to test this theory because, as I mentioned previously, when I try to edit the Redirect URL input in App Settings it throws a 403 Forbidden.

I will send you a PM with my contact info so you can reach out

Dave

[DaveB222]

@Gordon-C Tried sending you a PM but it keeps complaining about bad language! Now its saying I've sent too many messages, maybe you can message me instead

[Gordon-C]

Hi @DaveB222 

I sent you an email directly.   If you do not see it in your inbox, please check your spam folder.

[nviolet]

I am also having trouble. @Gordon-C or @DaveB222 have you been able to reconcile? I tried to set this up yesterday. I am NOT a developer but got all the way through to the end and it says forbidden. Help please!!!

[DaveB222]

Hi @nviolet , Gordon is looking into this issue for me, I think it might be related to the redirect_uri as we have saved multiple URI's in our app settings. Are you doing the same?

[Gordon-C]

Hi @DaveB222 

I sent you an email but haven't heard back from you.   I completed some testing and was able to determine one cause for the error.  I see your redirect URLs have the extension *.xhtml.  If I change the extension to *.html, it works.  When I go back to *.xhtml, I get the 403 error.  Have you always used the redirect URLs with the *.xhtml extension?

[DaveB222]

Hi Gordon,

I did get your email thank you, just not had time to look into it yet.

Yes we have always used .xhtml extensions for the redirect_uri's (for 8+ years I believe, they have not changed)

I can look at setting up some redirect rules on our server as a short term fix for this, would be great if this could be raised as a bug your end though

Regards

David

[DaveB222 · Accepted solution]

Hi @Gordon-C ,

I removed all the *.xhtml extensions from the redirect URL's, I also had to do the same with the privacy URL's too before it would allow me to save.

The App is now working (I am using a rewrite rule as a workaround)

Thanks for your time looking into this

David

[rory22]

I am having this same issue. Can someone help me with it 

[hairbitch]

Hi, I don't know if this will reach you but I've been getting the 403 forbidden response when I try to link my FitBit (Versa 4) to my WeightWatchers app. I've deleted my info on both apps, uninstalled, turned off my Iphone, and reinstalled. Still 403 forbidden. WeightWatchers says it's on your end, you guys say it's WeightWatchers. Either way I can't get them to sync. I feel like it has something to do with permissions, but I don't know how to go about figuring it out. I've been all over both apps to see if something is turned off or unclicked. Even got other (smarter than me) people to help. Nothing. Went to the Apple store,they can't figure it out either. Any thoughts?

I just now got my 9 year anniversary of being with FitBit Badge. I'm so frustrated. 

[GordonFitbit]

Hi @hairbitch 

Since WeightWatchers implemented the authorization flow using our Web API, the problem is likely related to them.  You were correct to contact Weight Watchers.  If they can't figure it out, Weight Watchers should reach out to us directly.  But, let me see if I can give you some information that you can take back to Weight Watchers.

Please follow these steps again so I can get look at our logs for the errors

1. Go to https://www.fitbit.com/settings/applications to list the application which you are linked to.  Next to Weight Watchers, please press the "Revoke Access" link.

2. Reconnect your Fitbit account to Weight Watchers.

3. If you get an error during linking, please provide me with the date/time which you received the error, the error code and any error messages that appearred.

Thanks!

Gordon

[hairbitch]

Hi,
Weight Watchers isn’t on the place for permission. There is nothing to
revoke. I don’t know how to add it so WW could have permission. (Hope that
makes sense)
Sadly, I’ve been working with Fitbit and WW for more than a week and I’m
utterly exhausted. It won’t work. So I’ve sent my Fitbit back for a refund.
I’m really sad about it. But Fitbit raised the bar for me by being
compatible with WW. Now that’s what I want. So I’m gonna go find something
else that will work.
Thank you for all of your time, I really do appreciate you.

Carol

[GordonFitbit]

Since there was nothing to revoke, then you currently don't have WW connected to your account and would just need to start with step 2/

I'm sorry we weren't able to get this to work.   I thought I could figure out the cause of the problem for you.  If you decide to try again, please reach out to us if you get the 4xx error again.