Unknown redirect_uri

[Moskus]

What should I set for redirect_uri when I don't know what it is?

My plugin for HomeSeer uses HomeSeers own web server, and can't know all the URIs the users have. It might be "http://localhost", "http://localhost:81", "http://some.public.ip" or any other combination you can think of.

[JeremiahFitbit]

All redirect_uri values must be stored in your app settings on https://dev.fitbit.com/apps . This is an important security requirement, as otherwise an evil-doing app could hijack your app's authorizations.

[Moskus]

If it's so much safer or not I'm sure can be discussed at length, but to me (or rather; my users) this represents a huge problem.

And the question still remains: What do you do when you don't know the redirect_uri because you are essentially developing a web server plugin?

[JeremiahFitbit]

---

@Moskus wrote:

If it's so much safer or not I'm sure can be discussed at length

---

This is called an open redirect and it's a well documented security risk.

---

@Moskus wrote:

And the question still remains: What do you do when you don't know the redirect_uri because you are essentially developing a web server plugin?

---

I'm not familiar with what your app does or how it works, but it seems like a less typical use case. Most third-party applications using the Fitbit Web API are operators of their application—either as a service or as a distributed application that can be invoked via a custom URL scheme (e.g. myapp://auth/fitbit/done).

Fitbit does not yet offer an OOB (out of bands) OAuth 2.0 flow. This is a flow typically used for TV apps, but could be used in a situation where the redirect_uri is unknown. This would be a flow that results in a short code displayed on the screen that a user could then copy/paste or type into a confirmation screen to complete the authorization.

If you are developing software for people to run on their own servers, they could register for their own client credentials at https://dev.fitbit.com/ and set their redirect URI.

Lastly, you could operate a service that allows people to register themselves with your service and set their final redirect URI. Then your app would be the redirect_uri for all of your users. Upon obtaining the access token and refresh token, your app would then redirect people to their specific destination.