Tag Info

Hot answers tagged

9

Some comments on the new features: Authentication I really dislike an authentication flow which mandates a call out to a browser. It makes command line applications basically impossible. It makes consistent UIs for specific platforms very hard (e.g. iPhone), as you basically have to dump the user into a web browser with an entirely different UI. It also ...


8

I would like to see fixed paging. And yes, that means I think the current system is broken. What do I mean by broken? When you want to get 500 newest questions and the page size is 100, it's impossible to do so without the possibility of duplicates (which are easy to ignore) or (much worse) missing questions. This happens because you can access page 1, ...


7

I would be interested in seeing a /me/votes route to get a list of all my upvotes and downvotes. Note that this would only apply to my voting history and not anyone else's.


6

Oy, that was an annoying one. Subtle, as the bug only happened when you're not logged in but would be automatically logged in when you visit stackexchange.com. The actual root cause was just over-encoding a url.


4

I had a similar issue a few months ago ago, and I came up with a couple of suggestions, one exactly like how you suggested: Ask the user for the email associated with their account, MD5 it, and compare it to the value provided by the API. This works, provided it isn't essential that the user is who he says he is - a users email may be publicly available, ...


4

There is none in version 1.1 of the API: all the information in the API is public. This is status-planned for version 2, however. Read more.


3

DNS went wonky on our end, this has been fixed, those responsible have been beaten. While there's a chance it still won't resolve for some folks, all that should shake itself out within the next 15 minutes or so.


2

This is relatively easy - just make him give you the same email address that he provided for his Stack Exchange account and then calculate the MD5 hash of the email address. Then compare that to the email_hash member of his account data. If the two hashes match, then the user is indeed who they claim to be. If not, they either provided a different email ...


2

I've updated the documentation with a section about errors. This behavior is defined more by the OAuth 2.0 spec than by me, so it's naturally a little out of sync with the rest of the API. Authentication is also just... weird when compared to pure data queries. The answer is, it depends. In no case during implicit authentication is a 400 possible, sine ...


2

I found answer myself and posted in my blog post StackAlert Firefox Extension error key is not valid for passed access_token Solution in brief When you remove the application from StackExchange apps, and even after uninstalling the extension from Firefox, you will still have traces of that extension in Firefox. To make this extension work again, we have ...


2

The implicit flow uses the url https://stackexchange.com/oauth/dialog, not https://stackexchange.com/oauth. You should just need to change the url, otherwise that looks correct.


2

key is your app key, access_token identifies a user (and a set of permissions) and is what you get at the end of an authentication flow. Keys are not secret, for example here's what the Documentation Console's registration looks like: You can find your app key by going to Manage Your Applications (in the Stack Apps homepage sidebar) and selecting one of ...


2

Reference: Stack Exchange API Authentication Looking for a beginner's tutorial to using the API Yeah the registration form now says, "Website URL is required". So, if you don't have your own website: Enter stackexchange.com as the Application Website. Enter stackexchange.com as the OAuth Domain. This will allow you to use ...


2

The fix for me was unchecking "Enable Client Side OAuth Flow"


1

Naturally my first vacation in two years, and I break something right before going offline. Sorry about that. This was fixed in the latest deploy.


1

If a user has any authorized applications, the apps tab appears on their profile pages. From the page linked a user can see their authorized applications, and de-authorize any of them. That link probably won't be conditionally displayed forever, but we haven't got anything to show in the "emtpy" case just yet.


1

The token does not appear because of the way urllib2 handles the redirect. I am not familiar with the details so I won't elaborate here. The solution is to catch the 302 before the urllib2 handles the redirect. This can be done by sub-classing the urllib2.HTTPRedirectHandler to get the redirect with its hashtag and token. Here is a short example of ...


1

This isn't possible, for simplicity reasons. Right now there are a few states a user can get into w.r.t. authentication: logged in, app not authorized need to authorize app app not in app tab logged in, app authorized no prompt app in app tab not logged in, app not authorized need to login, then authorize app app not in app tab not logged in, app ...


1

You shouldn't get prompted when acquiring an access token if you've previously authorized the app and have not explicitly removed it. That is by design. I can't reproduce access tokens remaining valid after removing the app, though there is a natural race there. It's entirely possible that an access token will remain valid for a small period after ...


1

This is just how OAuth 2.0 indicates rejection, you get different values on the redirect (either in the hash for the implicit client side flow, or in proper query string parameters for the explicit server side flow). Instead of code or access_token (depending on the flow the app is using) you get error and error_description. When a user rejects you get ...


1

(Should this be an answer?) I don't understand why there is an /users/{ids}/inbox. Surely there only should be /users/me/inbox? And it is nice to see the /events route (just wish there was webhooks or something as well. About the filters, we must send a list of fields we want to a filters route, receive an id (I'm not sure what an opaque value is, sorry) ...



Only top voted, non community-wiki answers of a minimum length are eligible