15

I am trying to get a non-expiry access token, like so:

https://stackexchange.com/oauth?scope=no_expiry&redirect_uri={{some_uri}}&client_id={{some_value}}

I am repeatedly getting the error:

Application Login Failure
An error occurred while login into an application.

Error Details
error description: Cannot return to provided redirect_uri

I have tried several values for `redirect_uri, such as:

  • https://www.yahoo.com/
    and
  • 10.**.**.**/myscript.php

None of them seem to be working.

0

1 Answer 1

11

Refer to the Stack Exchange API, Authentication docs. It looks like you are trying to authenticate using either a server you do not control, or a local server that is not on the public internet.

Crucial Points:

  1. Do not specify a redirect_uri to any server that you do not control.
    When you use something like redirect_uri=https://www.yahoo.com/, then a third party host has you, or your user's, credentials! That page/server will see a request like:

    https://www.yahoo.com/#access_token=X0duhxxxxxxxxxxxNvfDbQ%29%29&expires=86399
    

    It can then use that access_token to do unspeakable evil.

    This is a major breach of both security and trust. (Frankly, if you or your app are caught doing this, lifetime bans should be issued. Legal action may even be appropriate in some cases.)

  2. The value you set for OAuth Domain must match the redirect_uri.

    So, if you use, redirect_uri=http://10.0.0.86/myscript.php,
    then you must set OAuth Domain to 10.0.0.86.

  3. If you do not have your own server:

    1. Use the "implicit OAuth 2.0 flow" (Client side). Activate Enable Client Side OAuth Flow in your app's control panel.
    2. Leave Disable Desktop Application OAuth Redirect Uri unchecked.
    3. Set OAuth Domain to stackexchange.com.
    4. Use redirect_uri=https://stackexchange.com/oauth/login_success.

  4. Be sure to use GET requests for implicit (client side) OAuth and POST for explicit (server-side) OAuth.


When the authentication is successful, the access_token will be in the location.hash of the redirected page. For example:

https://stackexchange.com/oauth/login_success#access_token=5bcPtLjiyuySD7WeKSo3Mw))&expires=86399
2
  • 1
    So i just need security token for one time. Instagram/Facebook use any redirect_uri and provide token on the URL itself. StackApps following the same model, i was expecting that any URL should work. Will try the point 2/3 and will update. Thanks for answering.
    – user34257
    Aug 14, 2015 at 4:18
  • 3
    The token is returned in the URL (hash). And, even for Instagram/Facebook it's a major security breach to use a 3rd-party URL. Aug 14, 2015 at 4:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .