Web API HttpRequest FileNotFoundException

[hyungiko2]

I'm using Fitbit Web API in my Android app. Everything worked well until last week, but there have been errors since I renew my token due to the expiration.

Following logs are the error. It seemed like an authorization problem, so I logged out and then logged in again. After that the problem was solved, but this happened again after a few hours. (I set the token expires_in one year.)

.setTokenExpiresIn(31536000L)

I think my token is being expired again and again. Is there anybody who have this issue? It was okay even until last week. Other clients who are using my app don't have this issue, so I don't know what the problem is.

I need your advice. Thanks.

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err: java.io.FileNotFoundException: https://api.fitbit.com/1/user/-/activities/heart/date/today/1d/1min.json

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:255)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getInputStream(DelegatingHttpsURLConnection.java:210)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getInputStream(Unknown Source:0)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at com.fitbit.fitbitcommon.network.BasicHttpRequest.execute(BasicHttpRequest.java:161)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at jordan.personicle.service.FitBitDataService.reqeustFitBitForTimely(FitBitDataService.java:98)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at jordan.personicle.service.FitBitDataService.onHandleIntent(FitBitDataService.java:86)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at android.app.IntentService$ServiceHandler.handleMessage(IntentService.java:68)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at android.os.Handler.dispatchMessage(Handler.java:105)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at android.os.Looper.loop(Looper.java:164)

07-13 21:46:43.713 1544-2539/jordan.personicle W/System.err:     at android.os.HandlerThread.run(HandlerThread.java:65)

[santolucito]

I am also having an issue with the API not honoring the 'expires_in' keyword. I even used this https://dev.fitbit.com/apps/oauthinteractivetutorial to construct the auth url. I am pretty sure the API is just broken at this point

[santolucito]

My mistake was not reading the docs carefully enough (as it always is)

To use the Implicit Grant Flow, you must set your OAuth 2.0 Application Type to Client in your application settings at dev.fitbit.com.

I was using the Personal app type and trying to use Implicit Grant Flow. Fitbit will not throw an error or even a warning in this case. It seems to default to giving you an Implicit Grant flow token, but with the duration of an Authorization Code Grant Flow token.

Almost seems like a security vulnerability here...

[hyungiko2]

Thanks for your reply. 

This app is a real-time tracking app. So, I keep requesting the data every 15 minutes. It is a client type authorized by Fitbit.

After re-logging in, it works well for a while, but suddenly happens above issues in a few hours. I just saw some logs which are something like "leak" problem from the http request. I didn't check the code yet, but is it possible to happen this issue if I don't correctly close the connection? I think there is an error before closing the connection at some moments, so it is not correctly closed. Is this possible scenario?

Thanks alot,

[santolucito]

I dont think authorization can be effected by keeping a connection open, but I am not expert. 

Can you see the HTTP error code, which might be more helpful/specific than the "leak" message

https://dev.fitbit.com/build/reference/web-api/oauth2/#authorization-request-errors

Also, the discord channel https://community.fitbit.com/t5/SDK-Development/Join-the-Unofficial-Fitbit-Discord-Chat-Server/td-p/... is a good way to get quicker replies

[hyungiko2]

Thanks,

One more detail is, it happens at following line.

final BasicHttpResponse response = request.execute();

So, I cannot get the response code but just an exception when it happens.

Anyway, thanks a lot!

Thanks,

[hyungiko2]

It returns this log.

07-17 20:08:20.339 9642-31276/jordan.personicle W/OkHttpClient: A connection to https://api.fitbit.com/ was leaked. Did you forget to close a response body?