Web API OAuthenticationFlow

[kumar_S]

Hello All,

I'm in need of some help handling the callback from the Web API after user authentication.

After the user authenticates, they receive an error stating that the developer has not provided correct redirect uri parameters.  I can assure you these are correct as i'm able to execute the complete process manually.  

I've also found that Fitbit diverts from specification for OAuth2Flow by:

https://dev.fitbit.com/build/reference/web-api/oauth2/

***According to the OAuth 2.0 RFC, if the redirect uri is valid, the user is redirected to the app redirect uri, and any errors are appended to the URI as a query string. However, this behavior could be used in a phishing attack. Therefore, Fitbit’s OAuth 2.0 implementation diverges from the spec in that the user will remain on https://www.fitbit.com/oauth2/authorize, and any errors will be displayed on the page. An error description URI parameter may also be provided to help diagnose the issue.

**

Does anyone know how to work around this?  All need to do is figure out how to obtain that code so I can complete the required post for token. 

Thank you for any help.

Steve

I'm working in c++.

[JohnFitbit]

Hi @kumar_S,

Welcome to the forums!

Can you provide me with your redirect_uri? Just because you are able to complete the process on your end doesn't necessarily mean an external user will be able to. For example, if you chose localhost (http://localhost) as your redirect URI, you'll be able to complete the authorization flow since you are connecting to your local network. However, if an external user attempted to authorize, the authorization would fail because localhost is not publicly accessible. 

Your redirect URI would need to be publicly accessible in order for the authorization flow to complete.