Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using the explicit OAuth flow and am getting errors when using the "code" value returned after a successful authentication.

Can anyone post a sample HTTP POST with a redacted secret value?

According to fiddler, this is what I'm posting:

Request 1 (my app to stackapps)

GET https://stackexchange.com/oauth?client_id=2705&redirect_uri=http://localhost:51633/LoginStackOverflow/SOResponse HTTP/1.1
Host: stackexchange.com
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.146 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: sredact

StackApps asks browser to login and validate access

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Set-Cookie: se-usr=t=KVcLWfAePEyT&s=4An2pCClwUiJ; expires=Thu, 04-Sep-2014 15:59:37 GMT; path=/; HttpOnly
Date: Tue, 04 Mar 2014 15:59:36 GMT
Content-Length: 8992

 Form POST data here...

Web browser POSTs the form

POST https://stackexchange.com/oauth/submit HTTP/1.1
Host: stackexchange.com
Connection: keep-alive
Content-Length: 179
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: https://stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.146 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://stackexchange.com/oauth?client_id=2705&redirect_uri=http://localhost:51633/LoginStackOverflow/SOResponse
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: redact

  client_id=2705&scope=&redirect_uri=http%3A%2F%2Flocalhost%3A51633%2FLoginStackOverflow%2FSOResponse&response_type=&state=&fkey=d31769fc63c296614c4e145e5fb214b2&user_action=Approve

On "approve" (not cancel) User is redirected

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: http://localhost:51633/LoginStackOverflow/SOResponse?code=7Gx8bWbB*ITD6Rasdf))
X-Frame-Options: SAMEORIGIN
Date: Tue, 04 Mar 2014 15:59:38 GMT
Content-Length: 199

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://localhost:51633/LoginStackOverflow/SOResponse?code=7Gx8bWbB*ITD6RzDasdf))">here</a>.</h2>
</body></html>

Browser does a get against RedirectURL

GET http://localhost:51633/LoginStackOverflow/SOResponse?code=7Gx8bWbB*ITD6RzDBAAN4A)) HTTP/1.1
Host: localhost:51633
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.146 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8

I now have the code so I query the server

POST https://stackexchange.com/oauth/access_token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: stackexchange.com
Content-Length: 166
Expect: 100-continue
Connection: Keep-Alive

code=7Gx8bWbB%2AITD6RzDBAAN4A%29%29&client_id=2705&secret=%29z9se6kINgPq7wjLfvZv9A%28%28&redirect_uri=http%3A%2F%2Flocalhost%3A51633%2FLoginStackOverflow%2FSOResponse

This is the server response

HTTP/1.1 400 Bad Request
Cache-Control: private
Content-Type: application/json; charset=utf-8
X-Frame-Options: SAMEORIGIN
Date: Tue, 04 Mar 2014 03:32:52 GMT
Content-Length: 78

{"error":{"type":"invalid_request","message":"app secret doesn\u0027t match"}}
share|improve this question
    
You've got client_id=2705&code=REDACT)), which suggests that you did not URL encode the parameters. It should be: client_id=2705&code=REDACT%29%29, etc. – Brock Adams Mar 4 '14 at 5:50
    
@BrockAdams I am using C#'s byte[] reqBytes = HttpUtility.UrlEncodeToBytes(redirectUrl); I'll try another way of encoding it... – LamonteCristo Mar 4 '14 at 13:51

Did you url-encode the code and the client_secret?

Here's a successful auth (from Firebug):

POST:

POST /oauth/access_token HTTP/1.1
Host: stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: *Never you mind!*
Connection: keep-alive

code=24WcedPbZuLiqsUpOBD6yQ%29%29&client_id=1515&client_secret=*redacted*&redirect_uri=*my web server as listed in app page, plus path to my auth app*


Response:

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/plain; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Date: Tue, 04 Mar 2014 05:28:03 GMT
Content-Length: 86

access_token=*redacted*&expires=86399


Note: I'm not worried about the code, above, it's already expired.
Also, I captured this with Firefox, hence the browser overhead and Cookie in the post. They are not needed in most cases.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .