5

For years, I've run a local PHP app using GuzzleHttp\Client to download my StackExchange posts.

Today, I'm suddenly getting this problem when posting my client_id, client_secret, code, redirect_uri.

{
    "error_message": "Couldn't parse `client_id`"
}

I've tried posting from https://reqbin.com/post-online too and get the same error.

Where can I find more about this error message and why I might be experiencing this suddenly?


Update:

At https://stackapps.com/apps/oauth/view/13067 I see that my OAuth Domain and Application Website are way outdated, but I doubt it's a problem, both because I don't think those values get used anywhere and also because the values I see here are so old that my app ought to have broken much earlier if these mattered.

I wonder if this relates to my problem. I get the Just a moment... response:

[2024-01-23 16:39:14] local.DEBUG: error response headers: {"Date":["Tue, 23 Jan 2024 16:39:13 GMT"],"Content-Type":["text\/html; charset=UTF-8"],"Content-Length":["12469"],"Connection":["close"],"Accept-CH":["Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA"],"Cross-Origin-Embedder-Policy":["require-corp"],"Cross-Origin-Opener-Policy":["same-origin"],"Cross-Origin-Resource-Policy":["same-origin"],"Origin-Agent-Cluster":["?1"],"Permissions-Policy":["accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()"],"Referrer-Policy":["same-origin"],"X-Frame-Options":["SAMEORIGIN"],"cf-mitigated":["challenge"],"Cache-Control":["private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0"],"Expires":["Thu, 01 Jan 1970 00:00:01 GMT"],"Set-Cookie":["__cf_bm=M4sphbT4igreiS2G4RwBnOpMN0Zfghmlk2O5xMLjxXk-1706027953-1-AdpY5d+6yWc9J7XPZmwRDG4Tv1X8g+Uxy3OrfERWdBdyI8yPlob9FKynrWo6PVTcZjBnXtwU\/qXCFuAo+fKfepk=; path=\/; expires=Tue, 23-Jan-24 17:09:13 GMT; domain=.stackoverflow.com; HttpOnly; Secure; SameSite=None"],"X-DNS-Prefetch-Control":["off"],"Server":["cloudflare"],"CF-RAY":["84a178b55a391d76-ATL"]}  
[2024-01-23 16:39:14] local.DEBUG: error response body: "<!DOCTYPE html><html lang=\"en-US\"><head><title>Just a moment...<\/title><meta http-equiv=\"Content-Type\" content=\"text\/html; charset=UTF-8\"><meta http-equiv=\"X-UA-Compatible\" content=\"IE=Edge\"><meta name=\"robots\" content=\"noindex,nofollow\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><style>@keyframes lds-ring{0%{transform:rotate(0deg)}to{transform:rotate(360deg)}}*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131}button,html{font-family:system-ui,-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,\"Helvetica Neue\",Arial,\"Noto Sans\",sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\"}@media (prefers-color-scheme:dark){body{background-color:#222;color:#d9d9d9}body a{color:#fff}body a:hover{text-decoration:underline;color:#ee730a}body .lds-ring div{border-color:#999 transparent transparent}body .font-red{color:#b20f03}body .big-button,body .pow-button{background-color:#4693ff;color:#1d1d1d}body #challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4)}}body{display:flex;flex-direction:column;min-height:100vh}body.no-js .loading-spinner{visibility:hidden}body.no-js .challenge-running{display:none}body.dark{background-color:#222;color:#d9d9d9}body.dark a{color:#fff}a:hover,body.dark a:hover,body.light a:hover{text-decoration:underline;color:#ee730a}body.dark .lds-ring div{border-color:#999 transparent transparent}body.dark .font-red{color:#b20f03}body.dark .big-button,body.dark .pow-button{background-color:#4693ff;color:#1d1d1d}body.dark #challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4)}body.light{color:#313131}a,body.light a{color:#0051c3}body.light .lds-ring div{border-color:#595959 transparent transparent}body.light .font-red{color:#fc574a}body.light .big-button,body.light .pow-button{border-color:#003681;background-color:#003681;color:#fff}body.light #challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=)}a,body.light{background-color:transparent}a{transition:color 150ms ease;text-decoration:none}.main-content{margin:8rem auto;width:100%;max-width:60rem}.heading-favicon{margin-right:.5rem;width:2rem;height:2rem}.footer,.main-content{padding-right:1.5rem;padding-left:1.5rem}.main-wrapper{display:flex;flex:1;flex-direction:column;align-items:center}.font-red{color:#b20f03}.spacer{margin:2rem 0}.h1{line-height:3.75rem;font-size:2.5rem;font-weight:500}.core-msg,.h2{line-height:2.25rem;font-size:1.5rem}.h2{font-weight:500}.body-text,.core-msg{font-weight:400}.body-text{line-height:1.25rem;font-size:1rem}#challenge-error-text,#challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}#challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=);padding-left:42px}.text-center{text-align:center}.big-button{transition-duration:200ms;transition-property:background-color,border-color,color;transition-timing-function:ease;border:.063rem solid #0051c3;border-radius:.313rem;padding:.375rem 1rem;line-height:1.313rem;font-size:.875rem}.big-button:hover{cursor:pointer}.captcha-prompt:not(.hidden){display:flex}.pow-button{margin:2rem 0;background-color:#0051c3;color:#fff}.pow-button:hover{border-color:#003681;background-color:#003681;color:#fff}.footer{margin:0 auto;width:100%;max-width:60rem;line-height:1.125rem;font-size:.75rem}.footer-inner{border-top:1px solid #d9d9d9;padding-top:1rem;padding-bottom:1rem}.clearfix::after{display:table;clear:both;content:\"\"}.clearfix .column{float:left;padding-right:1.5rem;width:50%}.diagnostic-wrapper{margin-bottom:.5rem}.footer .ray-id{text-align:center}.footer .ray-id code{font-family:monaco,courier,monospace}.core-msg,.zone-name-title{overflow-wrap:break-word}.loading-spinner{height:76.391px}.lds-ring,.lds-ring div{display:inline-block;position:relative;width:1.875rem;height:1.875rem}.lds-ring div{box-sizing:border-box;display:block;position:absolute;border:.3rem solid #595959;border-radius:50%;border-color:#313131 transparent transparent;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite}.lds-ring div:nth-child(1){animation-delay:-.45s}.lds-ring div:nth-child(2){animation-delay:-.3s}.lds-ring div:nth-child(3){animation-delay:-.15s}@media screen and (-ms-high-contrast:active),screen and (-ms-high-contrast:none){.main-wrapper,body{display:block}}<\/style><meta http-equiv=\"refresh\" content=\"375\"><\/head><body class=\"no-js\"><div class=\"main-wrapper\" role=\"main\"><div class=\"main-content\"><noscript><div id=\"challenge-error-title\"><div class=\"h2\"><span id=\"challenge-error-text\">Enable JavaScript and cookies to continue<\/span><\/div><\/div><\/noscript><\/div><\/div><script>(function(){window._cf_chl_opt={cvId: '3',cZone: \"stackoverflow.com\",cType: 'managed',cNounce: '2140',cRay: '84a178b55a391d76',cHash: '0a3b5d81d64aa93',cUPMDTk: \"\\\/oauth\\\/access_token\\\/json?__cf_chl_tk=QiOBIBGzbeGLitdez0nd.oFbkKwGn8SC318Y5XdmFkM-1706027953-0-gaNycGzNDCU\",cFPWv: 'g',cTTimeMs: '1000',cMTimeMs: '375000',cTplV: 5,cTplB: 'cf',cK: \"visitor-time\",fa: \"\\\/oauth\\\/access_token\\\/json?__cf_chl_f_tk=QiOBIBGzbeGLitdez0nd.oFbkKwGn8SC318Y5XdmFkM-1706027953-0-gaNycGzNDCU\",md: \"KQgMFJ9Md.BC.FulrOxwDMaTFgnAFmCn3fO7qX6NUVk-1706027953-1-ATs4kjJwH2__RLolvfSqcp8Pgix_VkaXH7nty04u1dpPZ1rsd5Tp-4Fmu_AnsetM519Lm4J39SeAEW8HgB4GpV_WLlr_kgIJ0SrnEIpJkNMOba25FXRSweTFbmrxm_sv01UR18Xz8Y1b6SHbT1AiRul2Ze778XNbtsMg96Fd1fBBH1U_57uQjGitT41c96G-pwvSZnVQXOX2R1ylMcUCBe-3E5yLB4SFNzq2aPm-772dYs4QG3pObrCcBjqMmJs_8Ly7E7XFRSVayYS4lYKZF1P0eBgSU54nkLdAH3ZQg3VWsrmyBPWtIC_45nsaTW6RlCumvKx3bFIf7iZ87pubFGF5sB3xTQiOlhLv0G2b8XUay7MISrKts2rlGLBISdvljpyVt_W5ZYYOGW3VX8dLPfE3vaBI97rdqw8RzRYK_mjeSHI0HgF0byGUGRjKxLgDPVpeBAEmwCxSoSkAxF6S4H8FJP1wMe-lLSQq_JYre2SG5dqWOLRfAre-cv1JP62Yp50qZAw5jIPe3LPy4QehR9LTpFFk0O5vnCuD7M43kWdu4bVihIJXdmLK-n6lMJ3TOaQV_75TfaO05H99JmyBmpJEkS32KZLvGajniuRRf4sU6qAApX6F4vOLCKWFtOfmvLFYRyu_U3t5OHlkGcchrya4zgxMtgoPFyOyiYiC56Nbpy-LuPbcEywGGekrEMFIRHLb9SJAs0Ze89ait76xnjAwhPq7UkKMnsNlcZFltZFl_2nh_lxnAlNj-7R339ZSG2w-Tb6a2vCKk8Y57-bvSrqjJaIZ2zELUaiWFZ6V5ifJRkV4OjdgzoF-LjIL2k09Bt2zD5hnxhTVWYJ7XDKi6JYtnrjB2-scyqiB1ODZ7TMCMTdWlHwfvzBYDImPchfInqcjWN3KZIfCJKTol72UhHQmCBs4c7Dy7sC3mTtsbcJxXn5uKVxamMH6c3kmL-dhdffmtiDqtwoM_AyGTmZN9M0vGx_D8osZDMccnaZpBCgW9WPfZrEeZYU-kf1KfRByGdOJZD7BNeqGxlnVFWFArjNQ1vKBrFVB2KQaADY_sjtR1zk_CkmbZ3M--mfU0IsbWzasdKqRR5ndv2saXjocmXBKBA4D41vneAhR7sk1d0mGSZrPRVXBr8XxoGw3KoR-qrsPqL1XfpVZZICx0ZuE6QvGQ3yVr776K1insCBYEcEqHchRAaNENn_bxmUovtBYYGR1uEdvNdF805MGuQiuMtxB4pZSOhu3QtTU8N0OcAuOgomrAiSStSM1lDGqAjrC11pFR3bnD6FO7FsLD6Dk0vVSJJZ0xMplfD9xYUjyAXVLRWQbANdEHzeUEUGpP9pWKFMxs917mQ6DhLf2OUggKTiQNJPPjeOJ8iMDs_FTnPXMr6A7nvneiGzsj4qa135ifoVionR4I8mmJ2MfYGylEjjXZRJfBRmmnOnPVT8i0AFBtsYAyoOT--BN8szrq-VkKT7S7y789ZkVrfgpZwFIxmbKCzywI93_7CiJC4am_S46L4q0_axgxtNVkbOaNWzmVArHSJKvKPq2v14ZtOQ1Xb-8DwUs9xoO2oxaXdipCtgZb6HYQXrupx1WEZWp77X6PkMpnnSyd6NaYmtM6qK1nwYarks-hfOW26RzzwFwyJ7QTF94K6C2k6K7O90yziMiys3ZhWLNqS5knRJYxHlQDPLSr4O76H-4JKoGwAYLNACeiV4UgpviNugh7OH3E5tLZ55otO_yVJzoZn-yokJhlMkAvaUSYoRlHbQPJJUFpumJUbMiQTOJssrJ2-KWdYhwOVni6VVieDY8iCOJ3ixOvdwbMEpps8elTBtSxY4FYqUi5Uo4NdlDVeZWZpFLGrVAqoJ9fkEcEBz_TymeTt0o4QhhEUVzxRc3wFR3EtXBVcS_gYw1uBDqtssuWoPxEv5L2sw88gU6NpPBItoIQeNn6UaQ4ajpjQlvMM0C81o1slIOAA1anfqNxI2YJo7ecSskxDSCTulE9pX7NuVhbzABSaI9vVLdI-51jqaUjPCsuRUCz_v1iQjIpqvAc29_W1jp-wiFZSxYBRMk_6_Ru8Je5zVzc9Y7hxMmWQLCvRFG-Pj85QETHKQXcvp4G-09VJ3lHts_MS_HcNdrv8lO0jP7PGdOvTzOzaQqd3I9cjMZj7R64EsJdvXrSArF8mBS4byBUMO13txbSsnGWxPirNKANTdH4PJoGtHWqIhEeNvUMQ9JeqB8dViVrsWCvrPlwYbSXrlfGCqMy_cG5URyXPYBKkqpfqY6tqPOb5zLm890r7I74CdW5TstZJC2hbxvcgOW0qC-BxrFZJqcHqNs-U2uaMoWaX5m6t9Cd51CGkwlDAwwt_LmDxdUozTjFTZRmuRja8_7PKluvONdScqIB9pVHmDyDfP5YFndOwl6xq4bS5c0PStLsTYadYpLZ9GGRL8_a1ffEoyYsQwGm1siDj39zLUtEBuWFj2GpStuRMC-vj9mBLvkkqvOVcRsOTvXH5Vmj8opNnCwYIESkA_hP3076NQk1IBGAIZdwJjEdZqAfj_1Y00d3llnKEL45G4zs513i-tTU8KObAZxSry5nElDZurSlciZ-i6Aacyeo8liARBZ66a_r8CVvfKtekLyUxbP0OAIO2xKjBY39wC63iouqrTLYepc0-7tnDldLD-JySVdiPR-oU-MC8rmpYKNRT0pCpbsSlVL5CJ2qAhwR6i0RiSEDarLJ29nyfzvFng1Vu6yMTcKQG1tss_NSk8lN8wq714vUS-DqELKFnAXsvYmJQGlpZuGrrw7jxMxmnrWCKz91l35823O9oGDcp4SjaQM78YgVfn6T4CP5V1zL1IGU-0bIYMrj7wm-U2lzdfu9SE8NY-Rcn6ZEaPz5wKOkniCo9AaTfuD6zQB6Aa4nca7LT60kMVpxMrR3QRgQl7t41gOhTlfUouTI1ei1TiFW_HSYqC1sU8suzOrvA6YIgzCntqxGVI2CA5tdKkDzNkc8pXCzfME2EZCIG7YgS6O_WSx86mVvJt3RNAd-9lcSBbft2ETPyRXWfTqRtpAfnYVKaQl\",cRq: {ru: 'aHR0cHM6Ly9zdGFja292ZXJmbG93LmNvbS9vYXV0aC9hY2Nlc3NfdG9rZW4vanNvbg==',ra: 'R3V6emxlSHR0cC83',rm: 'UE9TVA==',d: 'uVQx77g\/O2NAe7v3yVhUpp5uuvN\/i4mGg6yWC9q6jFwI8jxKKVutUhokeIOgTypZ5TSF+tLRgAuBm76o2BI7QYeXopjW0xE9cuNo62pLT0lIXCfGpEdAurrlHXEMBHjGfgpItL7iSlizC5mhnsX5og\/gv+gVuUFg82qYLs9fBZaqXSLU\/gjfZLVzVpJ2PzmTwwjuGZvR3UlEYqXortJQt2+VhpVlO0U\/1Y28Kypo8lBhzLYVDXTUBRx8dz+RJlA8MjENw7i0hRgPPBslFkQ9AHoMveTHFg3wwXk13u4eK\/KVqFEY7GXB+OoctIoLhlCkZ0NISfvBVzfm8mWDwHhVGc+Q55IivuMCYuBuB8F5SEjuU94IOdhygRkoCHVZAWhjrp5zSz2Cjv8k2h7yK3Ogsc6MEgeVUiUyEEVrN5mBgdDfLvWZpNywQopdo2\/D1Oj3YmVW+VjeTQmxVNGg6YVzVFZ\/1TrHvGALw+Supz7\/E+pAclfhVxF7HFIbxl+lbsRBCO\/SyY5xdXMQvRr7ga0WvYaOGnrPxhH7SkiPvulNH1qShnPJBE4P2jtb0S51AzD0WRiD2w2MXqbAYJm2gtKWEQ8QozEEDWJkcu8T4MbKJi4=',t: 'MTcwNjAyNzk1My41MjQwMDA=',cT: Math.floor(Date.now() \/ 1000),m: '3g5ItVXucieXipAU3N9eVv+D8\/bUn\/Qdqp1RgJQiWlg=',i1: 'J5cZ2dkRdP03SMYmvvXMbQ==',i2: 'FNj8mNR1CUvFdBo2kkZ4xA==',zh: 'qZdVWT6Z9Deue7trOoFeIlRkJLjtvxnEfzC3GTwNVhI=',uh: 'ymmJQbck0hqyRMriiC\/yAd1aQMNFP4RloXqn1EtTLaU=',hh: 'ECNCiHdYYYxqofbBsqa9fYr8WYRYj05Gt6W8lzwsMKQ=',}};var cpo = document.createElement('script');cpo.src = '\/cdn-cgi\/challenge-platform\/h\/g\/orchestrate\/chl_page\/v1?ray=84a178b55a391d76';window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#' : location.hash;window._cf_chl_opt.cOgUQuery = location.search === '' && location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;if (window.history && window.history.replaceState) {var ogU = location.pathname + window._cf_chl_opt.cOgUQuery + window._cf_chl_opt.cOgUHash;history.replaceState(null, null, \"\\\/oauth\\\/access_token\\\/json?__cf_chl_rt_tk=QiOBIBGzbeGLitdez0nd.oFbkKwGn8SC318Y5XdmFkM-1706027953-0-gaNycGzNDCU\" + window._cf_chl_opt.cOgUHash);cpo.onload = function() {history.replaceState(null, null, ogU);}}document.getElementsByTagName('head')[0].appendChild(cpo);}());<\/script><\/body><\/html>"  
11
  • I can't reproduce. You are doing the explicit OAuth 2.0 flow, right? If so, which steps fails in api.stackexchange.com/docs/authentication then? Step 1 or Step 4?
    – rene
    Commented Jan 19 at 21:16
  • @rene Step 4 of explicit auth. Thanks.
    – Ryan
    Commented Jan 20 at 2:19
  • When was the last time this worked for you?
    – Makyen
    Commented Jan 21 at 16:04
  • 1
    I don't have a view of the network traffic for our project which uses the explicit flow. However, I have attempted a sequence of actions which requires the explicit flow to be functioning and was able to authorize. In other words, I don't appear to be able to reproduce the issue. IIRC, "SE API: Recent OAuth 2.0 implicit flow breaking change" doesn't affect the explicit flow, but is the last change I recall seeing. The last we had a problem with the explicit flow, the issue was that we were consistently running out of SE API quota.
    – Makyen
    Commented Jan 21 at 16:50
  • @Makyen Thanks. Mine still isn't working, and I haven't figured it out yet. I'll post another clue I noticed though:
    – Ryan
    Commented Jan 21 at 22:35
  • I wonder if this relates to my problem (stackoverflow.com/q/77446750/470749). I'm getting GuzzleHttp\Exception\ClientException: Client error: `POST https://stackoverflow.com/oauth/access_token/json` resulted in a `403 Forbidden` response: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/htm (truncated...) in /mnt/c/code/stackExchangeBackupDemo2/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:113
    – Ryan
    Commented Jan 21 at 22:35
  • api.stackexchange.com/docs/authentication hasn't been helpful. At stackapps.com/apps/oauth/view/13067 I see that my OAuth Domain and Application Website are way outdated, but I doubt it's a problem, both because I don't think those values get used anywhere and also because the values I see here are so old that my app ought to have broken much earlier if these mattered. By posting into reqbin.com/post-online in x-www-form-urlencoded mode instead of application/json, I'm able to retrieve an access_token. This still doesn't explain why my app is suddenly broken.
    – Ryan
    Commented Jan 21 at 22:57
  • So you're saying that you posted to stackoverflow.com/oauth/access_token/json with an application/json content and that is now broken, but using application/x-www-form-urlencoded on that same end-point works. I didn't assume that application/json on oauth/access_token/json was even an option because the docs don't state that. Only that the response will be a json object.
    – rene
    Commented Jan 22 at 15:14
  • @rene Ignore that I even tried application/json when using reqbin since that was a mistake, and my PHP app has always been posting form_params like stackoverflow.com/a/34411797/470749. I don't know why my PHP app would start receiving these unhelpful error messages when I haven't changed the app in probably years, and it's worked for a long time.
    – Ryan
    Commented Jan 22 at 15:57
  • How long is the UserAgent header that is send in the request by Guzzle? If it is the default one it might be too short: meta.stackexchange.com/a/328381
    – rene
    Commented Jan 23 at 16:56
  • @rene Thanks for the idea. But even after using 'headers' => [ 'User-Agent' => "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", ], I still get the Just a moment... error response.
    – Ryan
    Commented Jan 24 at 0:04

1 Answer 1

5

I expect this to be solved by Cloudflare protection is triggering on Stack Overflow authentication API routes


To reproduce and/or verify this you can use this glitch app for which you can find the code for here. Feel free to remix.

The crucial issue is the POST in Step 4 of the explicit OAuth flow.

The docs state:

POST (application/x-www-form-urlencoded) the following parameters to https://stackoverflow.com/oauth/access_token

and then later states:

In order to get access_token and expires (if applicable) wrapped in a JSON object, POST to https://stackoverflow.com/oauth/access_token/json instead.

You assumed that posting to oauth/access_token/json with an application/json contenttype would work. And by your own claim and my own logic I would expect that to work. The docs however never say that application/json is a valid content-type. It only states that data should be posted as application/x-www-form-urlencoded.

In the glitch app we can easily verify each option by ticking the boxes and click login:

enter image description here

path POST contenttype result
oauth/access_token/json x-www-form-urlencoded success
oauth/access_token/json application/json {"error_message":"Couldn't parse ``client_id``"}
oauth/access_token x-www-form-urlencoded success
oauth/access_token application/json HTTP error: 400 Bad Request Couldn't parse `client_id``

I'll mark the question as as this either is a regression or the code now adheres the documentation in which case it can use a clarifying edit. Both need an SE developer to look into. Hold your breath for 6 to 8 weeks.

3
  • I really appreciate all of your effort on this! But I wonder if it's not what I'm saying. See stackapps.com/questions/10497/… The 403 error with Just a moment... is what's new for me, and I don't know why my app started experiencing that recently.
    – Ryan
    Commented Jan 22 at 23:37
  • @Ryan that is not the error message you stated in your question. The Just a moment is a side-effect of CloudFlare: meta.stackexchange.com/questions/393242/… but all incidents that involved that change have been handled and I definitely don't see it on the end-points involved here. Can you add the exact HTTP content of what you receive, including headers in your question.
    – rene
    Commented Jan 22 at 23:45
  • I added the logs to the question above. Thanks for taking a look!
    – Ryan
    Commented Jan 23 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .