5

For years, I've run a local PHP app using GuzzleHttp\Client to download my StackExchange posts.

Today, I'm suddenly getting this problem when posting my client_id, client_secret, code, redirect_uri.

{
    "error_message": "Couldn't parse `client_id`"
}

I've tried posting from https://reqbin.com/post-online too and get the same error.

Where can I find more about this error message and why I might be experiencing this suddenly?

Update:

At https://stackapps.com/apps/oauth/view/13067 I see that my OAuth Domain and Application Website are way outdated, but I doubt it's a problem, both because I don't think those values get used anywhere and also because the values I see here are so old that my app ought to have broken much earlier if these mattered.

I wonder if this relates to my problem. I get the Just a moment... response:

[2024-01-23 16:39:14] local.DEBUG: error response headers: {"Date":["Tue, 23 Jan 2024 16:39:13 GMT"],"Content-Type":["text\/html; charset=UTF-8"],"Content-Length":["12469"],"Connection":["close"],"Accept-CH":["Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA"],"Cross-Origin-Embedder-Policy":["require-corp"],"Cross-Origin-Opener-Policy":["same-origin"],"Cross-Origin-Resource-Policy":["same-origin"],"Origin-Agent-Cluster":["?1"],"Permissions-Policy":["accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()"],"Referrer-Policy":["same-origin"],"X-Frame-Options":["SAMEORIGIN"],"cf-mitigated":["challenge"],"Cache-Control":["private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0"],"Expires":["Thu, 01 Jan 1970 00:00:01 GMT"],"Set-Cookie":["__cf_bm=M4sphbT4igreiS2G4RwBnOpMN0Zfghmlk2O5xMLjxXk-1706027953-1-AdpY5d+6yWc9J7XPZmwRDG4Tv1X8g+Uxy3OrfERWdBdyI8yPlob9FKynrWo6PVTcZjBnXtwU\/qXCFuAo+fKfepk=; path=\/; expires=Tue, 23-Jan-24 17:09:13 GMT; domain=.stackoverflow.com; HttpOnly; Secure; SameSite=None"],"X-DNS-Prefetch-Control":["off"],"Server":["cloudflare"],"CF-RAY":["84a178b55a391d76-ATL"]}  
[2024-01-23 16:39:14] local.DEBUG: error response body: "<!DOCTYPE html><html lang=\"en-US\"><head><title>Just a moment...<\/title><meta http-equiv=\"Content-Type\" content=\"text\/html; charset=UTF-8\"><meta http-equiv=\"X-UA-Compatible\" content=\"IE=Edge\"><meta name=\"robots\" content=\"noindex,nofollow\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><style>@keyframes lds-ring{0%{transform:rotate(0deg)}to{transform:rotate(360deg)}}*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131}button,html{font-family:system-ui,-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,\"Helvetica Neue\",Arial,\"Noto Sans\",sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\"}@media (prefers-color-scheme:dark){body{background-color:#222;color:#d9d9d9}body a{color:#fff}body a:hover{text-decoration:underline;color:#ee730a}body .lds-ring div{border-color:#999 transparent transparent}body .font-red{color:#b20f03}body .big-button,body .pow-button{background-color:#4693ff;color:#1d1d1d}body #challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4)}}body{display:flex;flex-direction:column;min-height:100vh}body.no-js .loading-spinner{visibility:hidden}body.no-js .challenge-running{display:none}body.dark{background-color:#222;color:#d9d9d9}body.dark a{color:#fff}a:hover,body.dark a:hover,body.light a:hover{text-decoration:underline;color:#ee730a}body.dark .lds-ring div{border-color:#999 transparent transparent}body.dark .font-red{color:#b20f03}body.dark .big-button,body.dark .pow-button{background-color:#4693ff;color:#1d1d1d}body.dark #challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjZDlkOWQ5IiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4)}body.light{color:#313131}a,body.light a{color:#0051c3}body.light .lds-ring div{border-color:#595959 transparent transparent}body.light .font-red{color:#fc574a}body.light .big-button,body.light .pow-button{border-color:#003681;background-color:#003681;color:#fff}body.light #challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=)}a,body.light{background-color:transparent}a{transition:color 150ms ease;text-decoration:none}.main-content{margin:8rem auto;width:100%;max-width:60rem}.heading-favicon{margin-right:.5rem;width:2rem;height:2rem}.footer,.main-content{padding-right:1.5rem;padding-left:1.5rem}.main-wrapper{display:flex;flex:1;flex-direction:column;align-items:center}.font-red{color:#b20f03}.spacer{margin:2rem 0}.h1{line-height:3.75rem;font-size:2.5rem;font-weight:500}.core-msg,.h2{line-height:2.25rem;font-size:1.5rem}.h2{font-weight:500}.body-text,.core-msg{font-weight:400}.body-text{line-height:1.25rem;font-size:1rem}#challenge-error-text,#challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}#challenge-success-text{background-image:url(data:image\/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI2IDI2Ij48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJNMTMgMGExMyAxMyAwIDEgMCAwIDI2IDEzIDEzIDAgMCAwIDAtMjZtMCAyNGExMSAxMSAwIDEgMSAwLTIyIDExIDExIDAgMCAxIDAgMjIiLz48cGF0aCBmaWxsPSIjMzEzMTMxIiBkPSJtMTAuOTU1IDE2LjA1NS0zLjk1LTQuMTI1LTEuNDQ1IDEuMzg1IDUuMzcgNS42MSA5LjQ5NS05LjYtMS40Mi0xLjQwNXoiLz48L3N2Zz4=);padding-left:42px}.text-center{text-align:center}.big-button{transition-duration:200ms;transition-property:background-color,border-color,color;transition-timing-function:ease;border:.063rem solid #0051c3;border-radius:.313rem;padding:.375rem 1rem;line-height:1.313rem;font-size:.875rem}.big-button:hover{cursor:pointer}.captcha-prompt:not(.hidden){display:flex}.pow-button{margin:2rem 0;background-color:#0051c3;color:#fff}.pow-button:hover{border-color:#003681;background-color:#003681;color:#fff}.footer{margin:0 auto;width:100%;max-width:60rem;line-height:1.125rem;font-size:.75rem}.footer-inner{border-top:1px solid #d9d9d9;padding-top:1rem;padding-bottom:1rem}.clearfix::after{display:table;clear:both;content:\"\"}.clearfix .column{float:left;padding-right:1.5rem;width:50%}.diagnostic-wrapper{margin-bottom:.5rem}.footer .ray-id{text-align:center}.footer .ray-id code{font-family:monaco,courier,monospace}.core-msg,.zone-name-title{overflow-wrap:break-word}.loading-spinner{height:76.391px}.lds-ring,.lds-ring div{display:inline-block;position:relative;width:1.875rem;height:1.875rem}.lds-ring div{box-sizing:border-box;display:block;position:absolute;border:.3rem solid #595959;border-radius:50%;border-color:#313131 transparent transparent;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite}.lds-ring div:nth-child(1){animation-delay:-.45s}.lds-ring div:nth-child(2){animation-delay:-.3s}.lds-ring div:nth-child(3){animation-delay:-.15s}@media screen and (-ms-high-contrast:active),screen and (-ms-high-contrast:none){.main-wrapper,body{display:block}}<\/style><meta http-equiv=\"refresh\" content=\"375\"><\/head><body class=\"no-js\"><div class=\"main-wrapper\" role=\"main\"><div class=\"main-content\"><noscript><div id=\"challenge-error-title\"><div class=\"h2\"><span id=\"challenge-error-text\">Enable JavaScript and cookies to continue<\/span><\/div><\/div><\/noscript><\/div><\/div><script>(function(){window._cf_chl_opt={cvId: '3',cZone: \"stackoverflow.com\",cType: 'managed',cNounce: '2140',cRay: '84a178b55a391d76',cHash: '0a3b5d81d64aa93',cUPMDTk: \"\\\/oauth\\\/access_token\\\/json?__cf_chl_tk=QiOBIBGzbeGLitdez0nd.oFbkKwGn8SC318Y5XdmFkM-1706027953-0-gaNycGzNDCU\",cFPWv: 'g',cTTimeMs: '1000',cMTimeMs: '375000',cTplV: 5,cTplB: 'cf',cK: \"visitor-time\",fa: \"\\\/oauth\\\/access_token\\\/json?__cf_chl_f_tk=QiOBIBGzbeGLitdez0nd.oFbkKwGn8SC318Y5XdmFkM-1706027953-0-gaNycGzNDCU\",md: \"KQgMFJ9Md.BC.FulrOxwDMaTFgnAFmCn3fO7qX6NUVk-1706027953-1-ATs4kjJwH2__RLolvfSqcp8Pgix_VkaXH7nty04u1dpPZ1rsd5Tp-4Fmu_AnsetM519Lm4J39SeAEW8HgB4GpV_WLlr_kgIJ0SrnEIpJkNMOba25FXRSweTFbmrxm_sv01UR18Xz8Y1b6SHbT1AiRul2Ze778XNbtsMg96Fd1fBBH1U_57uQjGitT41c96G-pwvSZnVQXOX2R1ylMcUCBe-3E5yLB4SFNzq2aPm-772dYs4QG3pObrCcBjqMmJs_8Ly7E7XFRSVayYS4lYKZF1P0eBgSU54nkLdAH3ZQg3VWsrmyBPWtIC_45nsaTW6RlCumvKx3bFIf7iZ87pubFGF5sB3xTQiOlhLv0G2b8XUay7MISrKts2rlGLBISdvljpyVt_W5ZYYOGW3VX8dLPfE3vaBI97rdqw8RzRYK_mjeSHI0HgF0byGUGRjKxLgDPVpeBAEmwCxSoSkAxF6S4H8FJP1wMe-lLSQq_JYre2SG5dqWOLRfAre-cv1JP62Yp50qZAw5jIPe3LPy4QehR9LTpFFk0O5vnCuD7M43kWdu4bVihIJXdmLK-n6lMJ3TOaQV_75TfaO05H99JmyBmpJEkS32KZLvGajniuRRf4sU6qAApX6F4vOLCKWFtOfmvLFYRyu_U3t5OHlkGcchrya4zgxMtgoPFyOyiYiC56Nbpy-LuPbcEywGGekrEMFIRHLb9SJAs0Ze89ait76xnjAwhPq7UkKMnsNlcZFltZFl_2nh_lxnAlNj-7R339ZSG2w-Tb6a2vCKk8Y57-bvSrqjJaIZ2zELUaiWFZ6V5ifJRkV4OjdgzoF-LjIL2k09Bt2zD5hnxhTVWYJ7XDKi6JYtnrjB2-scyqiB1ODZ7TMCMTdWlHwfvzBYDImPchfInqcjWN3KZIfCJKTol72UhHQmCBs4c7Dy7sC3mTtsbcJxXn5uKVxamMH6c3kmL-dhdffmtiDqtwoM_AyGTmZN9M0vGx_D8osZDMccnaZpBCgW9WPfZrEeZYU-kf1KfRByGdOJZD7BNeqGxlnVFWFArjNQ1vKBrFVB2KQaADY_sjtR1zk_CkmbZ3M--mfU0IsbWzasdKqRR5ndv2saXjocmXBKBA4D41vneAhR7sk1d0mGSZrPRVXBr8XxoGw3KoR-qrsPqL1XfpVZZICx0ZuE6QvGQ3yVr776K1insCBYEcEqHchRAaNENn_bxmUovtBYYGR1uEdvNdF805MGuQiuMtxB4pZSOhu3QtTU8N0OcAuOgomrAiSStSM1lDGqAjrC11pFR3bnD6FO7FsLD6Dk0vVSJJZ0xMplfD9xYUjyAXVLRWQbANdEHzeUEUGpP9pWKFMxs917mQ6DhLf2OUggKTiQNJPPjeOJ8iMDs_FTnPXMr6A7nvneiGzsj4qa135ifoVionR4I8mmJ2MfYGylEjjXZRJfBRmmnOnPVT8i0AFBtsYAyoOT--BN8szrq-VkKT7S7y789ZkVrfgpZwFIxmbKCzywI93_7CiJC4am_S46L4q0_axgxtNVkbOaNWzmVArHSJKvKPq2v14ZtOQ1Xb-8DwUs9xoO2oxaXdipCtgZb6HYQXrupx1WEZWp77X6PkMpnnSyd6NaYmtM6qK1nwYarks-hfOW26RzzwFwyJ7QTF94K6C2k6K7O90yziMiys3ZhWLNqS5knRJYxHlQDPLSr4O76H-4JKoGwAYLNACeiV4UgpviNugh7OH3E5tLZ55otO_yVJzoZn-yokJhlMkAvaUSYoRlHbQPJJUFpumJUbMiQTOJssrJ2-KWdYhwOVni6VVieDY8iCOJ3ixOvdwbMEpps8elTBtSxY4FYqUi5Uo4NdlDVeZWZpFLGrVAqoJ9fkEcEBz_TymeTt0o4QhhEUVzxRc3wFR3EtXBVcS_gYw1uBDqtssuWoPxEv5L2sw88gU6NpPBItoIQeNn6UaQ4ajpjQlvMM0C81o1slIOAA1anfqNxI2YJo7ecSskxDSCTulE9pX7NuVhbzABSaI9vVLdI-51jqaUjPCsuRUCz_v1iQjIpqvAc29_W1jp-wiFZSxYBRMk_6_Ru8Je5zVzc9Y7hxMmWQLCvRFG-Pj85QETHKQXcvp4G-09VJ3lHts_MS_HcNdrv8lO0jP7PGdOvTzOzaQqd3I9cjMZj7R64EsJdvXrSArF8mBS4byBUMO13txbSsnGWxPirNKANTdH4PJoGtHWqIhEeNvUMQ9JeqB8dViVrsWCvrPlwYbSXrlfGCqMy_cG5URyXPYBKkqpfqY6tqPOb5zLm890r7I74CdW5TstZJC2hbxvcgOW0qC-BxrFZJqcHqNs-U2uaMoWaX5m6t9Cd51CGkwlDAwwt_LmDxdUozTjFTZRmuRja8_7PKluvONdScqIB9pVHmDyDfP5YFndOwl6xq4bS5c0PStLsTYadYpLZ9GGRL8_a1ffEoyYsQwGm1siDj39zLUtEBuWFj2GpStuRMC-vj9mBLvkkqvOVcRsOTvXH5Vmj8opNnCwYIESkA_hP3076NQk1IBGAIZdwJjEdZqAfj_1Y00d3llnKEL45G4zs513i-tTU8KObAZxSry5nElDZurSlciZ-i6Aacyeo8liARBZ66a_r8CVvfKtekLyUxbP0OAIO2xKjBY39wC63iouqrTLYepc0-7tnDldLD-JySVdiPR-oU-MC8rmpYKNRT0pCpbsSlVL5CJ2qAhwR6i0RiSEDarLJ29nyfzvFng1Vu6yMTcKQG1tss_NSk8lN8wq714vUS-DqELKFnAXsvYmJQGlpZuGrrw7jxMxmnrWCKz91l35823O9oGDcp4SjaQM78YgVfn6T4CP5V1zL1IGU-0bIYMrj7wm-U2lzdfu9SE8NY-Rcn6ZEaPz5wKOkniCo9AaTfuD6zQB6Aa4nca7LT60kMVpxMrR3QRgQl7t41gOhTlfUouTI1ei1TiFW_HSYqC1sU8suzOrvA6YIgzCntqxGVI2CA5tdKkDzNkc8pXCzfME2EZCIG7YgS6O_WSx86mVvJt3RNAd-9lcSBbft2ETPyRXWfTqRtpAfnYVKaQl\",cRq: {ru: 'aHR0cHM6Ly9zdGFja292ZXJmbG93LmNvbS9vYXV0aC9hY2Nlc3NfdG9rZW4vanNvbg==',ra: 'R3V6emxlSHR0cC83',rm: 'UE9TVA==',d: 'uVQx77g\/O2NAe7v3yVhUpp5uuvN\/i4mGg6yWC9q6jFwI8jxKKVutUhokeIOgTypZ5TSF+tLRgAuBm76o2BI7QYeXopjW0xE9cuNo62pLT0lIXCfGpEdAurrlHXEMBHjGfgpItL7iSlizC5mhnsX5og\/gv+gVuUFg82qYLs9fBZaqXSLU\/gjfZLVzVpJ2PzmTwwjuGZvR3UlEYqXortJQt2+VhpVlO0U\/1Y28Kypo8lBhzLYVDXTUBRx8dz+RJlA8MjENw7i0hRgPPBslFkQ9AHoMveTHFg3wwXk13u4eK\/KVqFEY7GXB+OoctIoLhlCkZ0NISfvBVzfm8mWDwHhVGc+Q55IivuMCYuBuB8F5SEjuU94IOdhygRkoCHVZAWhjrp5zSz2Cjv8k2h7yK3Ogsc6MEgeVUiUyEEVrN5mBgdDfLvWZpNywQopdo2\/D1Oj3YmVW+VjeTQmxVNGg6YVzVFZ\/1TrHvGALw+Supz7\/E+pAclfhVxF7HFIbxl+lbsRBCO\/SyY5xdXMQvRr7ga0WvYaOGnrPxhH7SkiPvulNH1qShnPJBE4P2jtb0S51AzD0WRiD2w2MXqbAYJm2gtKWEQ8QozEEDWJkcu8T4MbKJi4=',t: 'MTcwNjAyNzk1My41MjQwMDA=',cT: Math.floor(Date.now() \/ 1000),m: '3g5ItVXucieXipAU3N9eVv+D8\/bUn\/Qdqp1RgJQiWlg=',i1: 'J5cZ2dkRdP03SMYmvvXMbQ==',i2: 'FNj8mNR1CUvFdBo2kkZ4xA==',zh: 'qZdVWT6Z9Deue7trOoFeIlRkJLjtvxnEfzC3GTwNVhI=',uh: 'ymmJQbck0hqyRMriiC\/yAd1aQMNFP4RloXqn1EtTLaU=',hh: 'ECNCiHdYYYxqofbBsqa9fYr8WYRYj05Gt6W8lzwsMKQ=',}};var cpo = document.createElement('script');cpo.src = '\/cdn-cgi\/challenge-platform\/h\/g\/orchestrate\/chl_page\/v1?ray=84a178b55a391d76';window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#' : location.hash;window._cf_chl_opt.cOgUQuery = location.search === '' && location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;if (window.history && window.history.replaceState) {var ogU = location.pathname + window._cf_chl_opt.cOgUQuery + window._cf_chl_opt.cOgUHash;history.replaceState(null, null, \"\\\/oauth\\\/access_token\\\/json?__cf_chl_rt_tk=QiOBIBGzbeGLitdez0nd.oFbkKwGn8SC318Y5XdmFkM-1706027953-0-gaNycGzNDCU\" + window._cf_chl_opt.cOgUHash);cpo.onload = function() {history.replaceState(null, null, ogU);}}document.getElementsByTagName('head')[0].appendChild(cpo);}());<\/script><\/body><\/html>"
Improve this question
11
  • I can't reproduce. You are doing the explicit OAuth 2.0 flow, right? If so, which steps fails in api.stackexchange.com/docs/authentication then? Step 1 or Step 4? Commented Jan 19, 2024 at 21:16
  • @rene Step 4 of explicit auth. Thanks. Commented Jan 20, 2024 at 2:19
  • When was the last time this worked for you? Commented Jan 21, 2024 at 16:04
  • 1
    I don't have a view of the network traffic for our project which uses the explicit flow. However, I have attempted a sequence of actions which requires the explicit flow to be functioning and was able to authorize. In other words, I don't appear to be able to reproduce the issue. IIRC, "SE API: Recent OAuth 2.0 implicit flow breaking change" doesn't affect the explicit flow, but is the last change I recall seeing. The last we had a problem with the explicit flow, the issue was that we were consistently running out of SE API quota. Commented Jan 21, 2024 at 16:50
  • @Makyen Thanks. Mine still isn't working, and I haven't figured it out yet. I'll post another clue I noticed though: Commented Jan 21, 2024 at 22:35
  • I wonder if this relates to my problem (stackoverflow.com/q/77446750/470749). I'm getting GuzzleHttp\Exception\ClientException: Client error: `POST https://stackoverflow.com/oauth/access_token/json` resulted in a `403 Forbidden` response: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/htm (truncated...) in /mnt/c/code/stackExchangeBackupDemo2/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:113 Commented Jan 21, 2024 at 22:35
  • api.stackexchange.com/docs/authentication hasn't been helpful. At stackapps.com/apps/oauth/view/13067 I see that my OAuth Domain and Application Website are way outdated, but I doubt it's a problem, both because I don't think those values get used anywhere and also because the values I see here are so old that my app ought to have broken much earlier if these mattered. By posting into reqbin.com/post-online in x-www-form-urlencoded mode instead of application/json, I'm able to retrieve an access_token. This still doesn't explain why my app is suddenly broken. Commented Jan 21, 2024 at 22:57
  • So you're saying that you posted to stackoverflow.com/oauth/access_token/json with an application/json content and that is now broken, but using application/x-www-form-urlencoded on that same end-point works. I didn't assume that application/json on oauth/access_token/json was even an option because the docs don't state that. Only that the response will be a json object. Commented Jan 22, 2024 at 15:14
  • @rene Ignore that I even tried application/json when using reqbin since that was a mistake, and my PHP app has always been posting form_params like stackoverflow.com/a/34411797/470749. I don't know why my PHP app would start receiving these unhelpful error messages when I haven't changed the app in probably years, and it's worked for a long time. Commented Jan 22, 2024 at 15:57
  • How long is the UserAgent header that is send in the request by Guzzle? If it is the default one it might be too short: meta.stackexchange.com/a/328381 Commented Jan 23, 2024 at 16:56
  • @rene Thanks for the idea. But even after using 'headers' => [ 'User-Agent' => "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", ], I still get the Just a moment... error response. Commented Jan 24, 2024 at 0:04

1 Answer 1

Reset to default
5

I expect this to be solved by Cloudflare protection is triggering on Stack Overflow authentication API routes

To reproduce and/or verify this you can use this glitch app for which you can find the code for here. Feel free to remix.

The crucial issue is the POST in Step 4 of the explicit OAuth flow.

The docs state:

POST (application/x-www-form-urlencoded) the following parameters to https://stackoverflow.com/oauth/access_token

and then later states:

In order to get access_token and expires (if applicable) wrapped in a JSON object, POST to https://stackoverflow.com/oauth/access_token/json instead.

You assumed that posting to oauth/access_token/json with an application/json contenttype would work. And by your own claim and my own logic I would expect that to work. The docs however never say that application/json is a valid content-type. It only states that data should be posted as application/x-www-form-urlencoded.

In the glitch app we can easily verify each option by ticking the boxes and click login:

enter image description here

path POST contenttype result
oauth/access_token/json x-www-form-urlencoded success
oauth/access_token/json application/json {"error_message":"Couldn't parse ``client_id``"}
oauth/access_token x-www-form-urlencoded success
oauth/access_token application/json HTTP error: 400 Bad Request Couldn't parse `client_id``

I'll mark the question as as this either is a regression or the code now adheres the documentation in which case it can use a clarifying edit. Both need an SE developer to look into. Hold your breath for 6 to 8 weeks.

Improve this answer
3
  • I really appreciate all of your effort on this! But I wonder if it's not what I'm saying. See stackapps.com/questions/10497/… The 403 error with Just a moment... is what's new for me, and I don't know why my app started experiencing that recently. Commented Jan 22, 2024 at 23:37
  • @Ryan that is not the error message you stated in your question. The Just a moment is a side-effect of CloudFlare: meta.stackexchange.com/questions/393242/… but all incidents that involved that change have been handled and I definitely don't see it on the end-points involved here. Can you add the exact HTTP content of what you receive, including headers in your question. Commented Jan 22, 2024 at 23:45
  • I added the logs to the question above. Thanks for taking a look! Commented Jan 23, 2024 at 16:42

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.