Take the 2-minute tour ×
Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.

I'm using the explicit OAuth flow and am getting errors when using the "code" value returned after a successful authentication.

Can anyone post a sample HTTP POST with a redacted secret value?

According to fiddler, this is what I'm posting:

Request 1 (my app to stackapps)

GET https://stackexchange.com/oauth?client_id=2705&redirect_uri=http://localhost:51633/LoginStackOverflow/SOResponse HTTP/1.1
Host: stackexchange.com
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.146 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: sredact

StackApps asks browser to login and validate access

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Set-Cookie: se-usr=t=KVcLWfAePEyT&s=4An2pCClwUiJ; expires=Thu, 04-Sep-2014 15:59:37 GMT; path=/; HttpOnly
Date: Tue, 04 Mar 2014 15:59:36 GMT
Content-Length: 8992

 Form POST data here...

Web browser POSTs the form

POST https://stackexchange.com/oauth/submit HTTP/1.1
Host: stackexchange.com
Connection: keep-alive
Content-Length: 179
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: https://stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.146 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://stackexchange.com/oauth?client_id=2705&redirect_uri=http://localhost:51633/LoginStackOverflow/SOResponse
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: redact

  client_id=2705&scope=&redirect_uri=http%3A%2F%2Flocalhost%3A51633%2FLoginStackOverflow%2FSOResponse&response_type=&state=&fkey=d31769fc63c296614c4e145e5fb214b2&user_action=Approve

On "approve" (not cancel) User is redirected

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: http://localhost:51633/LoginStackOverflow/SOResponse?code=7Gx8bWbB*ITD6Rasdf))
X-Frame-Options: SAMEORIGIN
Date: Tue, 04 Mar 2014 15:59:38 GMT
Content-Length: 199

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://localhost:51633/LoginStackOverflow/SOResponse?code=7Gx8bWbB*ITD6RzDasdf))">here</a>.</h2>
</body></html>

Browser does a get against RedirectURL

GET http://localhost:51633/LoginStackOverflow/SOResponse?code=7Gx8bWbB*ITD6RzDBAAN4A)) HTTP/1.1
Host: localhost:51633
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.146 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8

I now have the code so I query the server

POST https://stackexchange.com/oauth/access_token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: stackexchange.com
Content-Length: 166
Expect: 100-continue
Connection: Keep-Alive

code=7Gx8bWbB%2AITD6RzDBAAN4A%29%29&client_id=2705&secret=%29z9se6kINgPq7wjLfvZv9A%28%28&redirect_uri=http%3A%2F%2Flocalhost%3A51633%2FLoginStackOverflow%2FSOResponse

This is the server response

HTTP/1.1 400 Bad Request
Cache-Control: private
Content-Type: application/json; charset=utf-8
X-Frame-Options: SAMEORIGIN
Date: Tue, 04 Mar 2014 03:32:52 GMT
Content-Length: 78

{"error":{"type":"invalid_request","message":"app secret doesn\u0027t match"}}
share|improve this question
    
You've got client_id=2705&code=REDACT)), which suggests that you did not URL encode the parameters. It should be: client_id=2705&code=REDACT%29%29, etc. –  Brock Adams Mar 4 at 5:50
    
@BrockAdams I am using C#'s byte[] reqBytes = HttpUtility.UrlEncodeToBytes(redirectUrl); I'll try another way of encoding it... –  makerofthings7 Mar 4 at 13:51

1 Answer 1

Did you url-encode the code and the client_secret?

Here's a successful auth (from Firebug):

POST:

POST /oauth/access_token HTTP/1.1
Host: stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: *Never you mind!*
Connection: keep-alive

code=24WcedPbZuLiqsUpOBD6yQ%29%29&client_id=1515&client_secret=*redacted*&redirect_uri=*my web server as listed in app page, plus path to my auth app*


Response:

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/plain; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Date: Tue, 04 Mar 2014 05:28:03 GMT
Content-Length: 86

access_token=*redacted*&expires=86399


Note: I'm not worried about the code, above, it's already expired.
Also, I captured this with Firefox, hence the browser overhead and Cookie in the post. They are not needed in most cases.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .