Skip to main content
Stack Apps

Return to Question

edited tags
Link
Brock Adams
Brock Adams
  • 13k
  • 5
  • 39
  • 64
added 5 characters in body; edited tags
Source Link
Brock Adams
Brock Adams
  • 13k
  • 5
  • 39
  • 64

I have a browser extension that uses oAuthOAuth2 to retrieve an access token. As recommended by https://api.stackexchange.com/docs/authentication, I use https://stackoverflow.com/oauth/login_success as the value of redirect_uri. 

To avoid inadvertently using the access token from other applications, I have inserted a unique identifier in the URL, so that the extension will only use access tokens that it has explicitly requested.

The URL for the OAuth is thus as follows:

https://stackoverflow.com/oauth/dialog?client_id=903&redirect_uri=https://stackexchange.com/oauth/login_success?robw&protocol=https&&scope=no_expiry,read_inbox

Upon succesful authentication, it used to redirect to:
https://stackexchange.com/oauth/login_success?robw&protocol=https#access_token=XX

A user recently reported that my extension was broken. This is apparently because they are redirected to the following instead:
https://stackexchange.com/oauth/login_success?protocol=https#access_token=XX

Is this a bug in OAuth (and will the value of redirect_uri be respected in a future update)? If not, what is the recommended way to authenticate users and avoid conflicts with other browser extensions that also use the recommended redirect_uri to authenticate users?

I have a browser extension that uses oAuth to retrieve an access token. As recommended by https://api.stackexchange.com/docs/authentication, I use https://stackoverflow.com/oauth/login_success as the value of redirect_uri. To avoid inadvertently using the access token from other applications, I have inserted a unique identifier in the URL, so that the extension will only use access tokens that it has explicitly requested.

The URL for the OAuth is thus as follows:

https://stackoverflow.com/oauth/dialog?client_id=903&redirect_uri=https://stackexchange.com/oauth/login_success?robw&protocol=https&&scope=no_expiry,read_inbox

Upon succesful authentication, it used to redirect to:
https://stackexchange.com/oauth/login_success?robw&protocol=https#access_token=XX

A user recently reported that my extension was broken. This is apparently because they are redirected to the following instead:
https://stackexchange.com/oauth/login_success?protocol=https#access_token=XX

Is this a bug in OAuth (and will the value of redirect_uri be respected in a future update)? If not, what is the recommended way to authenticate users and avoid conflicts with other browser extensions that also use the recommended redirect_uri to authenticate users?

I have a browser extension that uses OAuth2 to retrieve an access token. As recommended by https://api.stackexchange.com/docs/authentication, I use https://stackoverflow.com/oauth/login_success as the value of redirect_uri. 

To avoid inadvertently using the access token from other applications, I have inserted a unique identifier in the URL, so that the extension will only use access tokens that it has explicitly requested.

The URL for the OAuth is thus as follows:

https://stackoverflow.com/oauth/dialog?client_id=903&redirect_uri=https://stackexchange.com/oauth/login_success?robw&protocol=https&&scope=no_expiry,read_inbox

Upon succesful authentication, it used to redirect to:
https://stackexchange.com/oauth/login_success?robw&protocol=https#access_token=XX

A user recently reported that my extension was broken. This is apparently because they are redirected to the following instead:
https://stackexchange.com/oauth/login_success?protocol=https#access_token=XX

Is this a bug in OAuth (and will the value of redirect_uri be respected in a future update)? If not, what is the recommended way to authenticate users and avoid conflicts with other browser extensions that also use the recommended redirect_uri to authenticate users?

Source Link
Rob W
Rob W
  • 2.7k
  • 3
  • 21
  • 19

OAuth redirect_uri to https://stackexchange.com/oauth/login_success?xxx strips part of the query string

I have a browser extension that uses oAuth to retrieve an access token. As recommended by https://api.stackexchange.com/docs/authentication, I use https://stackoverflow.com/oauth/login_success as the value of redirect_uri. To avoid inadvertently using the access token from other applications, I have inserted a unique identifier in the URL, so that the extension will only use access tokens that it has explicitly requested.

The URL for the OAuth is thus as follows:

https://stackoverflow.com/oauth/dialog?client_id=903&redirect_uri=https://stackexchange.com/oauth/login_success?robw&protocol=https&&scope=no_expiry,read_inbox

Upon succesful authentication, it used to redirect to:
https://stackexchange.com/oauth/login_success?robw&protocol=https#access_token=XX

A user recently reported that my extension was broken. This is apparently because they are redirected to the following instead:
https://stackexchange.com/oauth/login_success?protocol=https#access_token=XX

Is this a bug in OAuth (and will the value of redirect_uri be respected in a future update)? If not, what is the recommended way to authenticate users and avoid conflicts with other browser extensions that also use the recommended redirect_uri to authenticate users?