Oauth2 redirect_uri not required error

[eminkowski]

On the Authorization page, the API documentation states for redirect_uri:

"Where Fitbit should send the user after the user grants or denies consent. Recommended. Required unless you have specified only one redirect URI for your application in the settings on dev.fitbit.com."

This worked fine until recently.  I tested this by

1. Logging out of fitbit.com.

2. Going to my authorization page, which redirects to:

https://www.fitbit.com/login?redirect=%2Foauth2%2Fauthorize%3Fclient_id%3Dxxxxxx%26redirect_uri%26response_type%3Dcode%26scope%3Dactivity%2Bheartrate%2Blocation%2Bnutrition%2Bprofile%2Bsettings%2Bsleep%2Bsocial%2Bweight%26state

3. Logging in on this redirect page.

4. Then receiving the following error message:

Developer information: invalid_request - Invalid redirect_uri parameter value

However, I do receive a success if I go back to my authorization page if I am already logged into Fitbit (avoiding this login redirect).

I also receive a success if I remove the empty "&redirect_uri" that I bolded above, which Fitbit places in the login URL's querystring.

I believe that if the redirect URI is not required when you only have one specified in your application settings, the blank "&redirect_uri" is what causes the error.

[JeremiahFitbit]

By specifying `redirect_uri` as a parameter, you're setting it to an empty string. An empty string does not match your defined redirect URIs in your app settings.

[eminkowski]

Hi,

I am not adding redirect_uri to the parameters. This is being done on the Fitbit side.

My JS code sets the page location to the Fitbit authorization page and does not include redirect_uri.

window.location = ["",
                    "https://www.fitbit.com/oauth2/authorize",
                    "?response_type=code&client_id=XXXXXX&scope=",
                    "activity%20heartrate%20location%20nutrition%20profile%20",
                    "settings%20sleep%20social%20weight"].join("");

The URL from my original post is what displays in the browser window.

[JeremiahFitbit]

Thanks for the report. We've validated the issue on our side and hope to have a fix in the next 3 weeks.

For now, you can work around this issue by specifying the redirect_uri in your Authorization Page URL.