something smells with the OAuth2

[jesusdoesntsave]

hi there community...

i have a nagging problem when using the OAuth2 for authorization and then requesting the access tokens and stuff. i do get state and code back after the authorization. when doing the next step - getting the long access code - using this as an example from https://dev.fitbit.com/docs/oauth2/#access-token-request

POST https://api.fitbit.com/oauth2/token
Authorization: Basic Y2xpZW50X2lkOmNsaWVudCBzZWNyZXQ=
Content-Type: application/x-www-form-urlencoded

client_id=22942C&grant_type=authorization_code&redirect_uri=http%3A%2F%2Fexample.com%2Fcallback&code=123456789 

instead of the example reply there i get this: 

"errorType":"invalid_request","message":"Redirect_uri mismatch: http%3A%2F%2Fredeem.tpgrewards.com%2Fhealth%2F. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}"

how is this possible since i just used the same callback url to get the authorization and now just trying to get the access tocken so i can test some requests? the url in the token call matches the app setup for the client id which is the same as the one used when doing the oauth2 athorization.

what am i doing wrong?

thanks...

[jesusdoesntsave]

it's the authorization that returns state. it's not being passed by me. it's passed to me. besides there is nothing about a state parameter in the documantation for the access token call...

[JeremiahFitbit]

I will make an edit to call this out in Fitbit's documentation. The Fitbit OAuth 2.0 documentation is supplemental to the official OAuth 2.0 specification (section 4.1.2).

[jesusdoesntsave]

there is something i'm doing that is pretty wrong but not sure what exactly.  here is the sequesnce of calls through a proxy:

this is the authorization. it turns out there is a state parameter. i'm using a AOuth2 php librery i found on line (the jmitchell38488 one):

HTTP/1.1 302 Found
Date: Mon, 01 Feb 2016 23:30:15 GMT
Server: Apache
X-Powered-By: PHP/5.6.0
Set-Cookie: PHPSESSID=hqa9gqjc8m5k8cptgs2kbqhvl7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: https://www.fitbit.com/oauth2/authorize?client_id=229YKV&redirect_uri=http%3A%2F%2Fredeem.tpgrewards...
Content-Length: 18
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

this is the redirect with the GET - state and code - rendered:

HTTP/1.1 200 OK
Date: Mon, 01 Feb 2016 23:30:19 GMT
Server: Apache
X-Powered-By: PHP/5.6.0
Content-Length: 158
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

array(0) {
}
array(2) {
  ["state"]=>
  string(32) "c4M53O8rtg3eQYSUT5FD18nFBFD0JFkJ"
  ["code"]=>
  string(40) "0bca070c44fa2ee497f3e77e028194c408b56884"
}



this is the attempt for the token. using curl. and rendiring the query to post. these are 2 attempts in a row. the first one returns "Redirect_uri mismatch" and the second "Missing 'grant_type' parameter value".  as you can see both query strings are the same but the errors are different and not making any sense... 

HTTP/1.1 200 OK
Date: Mon, 01 Feb 2016 23:30:56 GMT
Server: Apache
X-Powered-By: PHP/5.6.0
Content-Length: 481
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

string(201) "client_id=229YKV&grant_type=authorization_code&redirect_uri=http%253A%252F%252Fredeem.tpgrewards.com%252Fhealth%252F&code=0bca070c44fa2ee497f3e77e028194c408b56884&state=c4M53O8rtg3eQYSUT5FD18nFBFD0JFkJ"
string(250) "{"errors":[{"errorType":"invalid_request","message":"Redirect_uri mismatch: http%3A%2F%2Fredeem.tpgrewards.com%2Fhealth%2F. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}"



HTTP/1.1 200 OK
Date: Mon, 01 Feb 2016 23:34:26 GMT
Server: Apache
X-Powered-By: PHP/5.6.0
Content-Length: 448
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

string(201) "client_id=229YKV&grant_type=authorization_code&redirect_uri=http%253A%252F%252Fredeem.tpgrewards.com%252Fhealth%252F&code=0bca070c44fa2ee497f3e77e028194c408b56884&state=c4M53O8rtg3eQYSUT5FD18nFBFD0JFkJ"
string(217) "{"errors":[{"errorType":"invalid_request","message":"Missing 'grant_type' parameter value. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}"

[JeremiahFitbit]

For the last two responses, can you please share the requests that generated them?

[JeremiahFitbit]

Are you double URI encoding your redirect_uri value?

I see:

http%253A%252F%252Fredeem.tpgrewards.com%252Fhealth%252F

which URI decodes to:

http%3A%2F%2Fredeem.tpgrewards.com%2Fhealth%2F

which then URI decodes to the unencoded value:

http://redeem.tpgrewards.com/health/

[jesusdoesntsave]

yea. that was one of the problems. the other one was that the fitbit url had a trailing slash. apparently that was a no-no too...

i finally got an access token.

thanks for sticking with this posting, Jeremiah... really appreciate your help here... i'm sure i'll be posting more questions soon...