Summary
Using Oauth2, when I go to pick up the access_token
, I get the following error from the server: access_denied: redirect_uri does not match the uri used to create the passed code
. From what I can tell, the redirect_uri
does match the one sent in the oauth
request.
Details
Request to the oauth
service:
After logging in and authorizing, post_data in the request to the https://stackexchange.com/oauth/access_token
service:
client_id=218&client_secret=n%29T7dAbutd0qDKp92ZwwMw%28%28&code=P%2AS4ZqH0gewVi8stHPAqlw%29%29&grant_type=authorization_code&redirect_uri=http%3A%2F%2Fwww.noverse.com%2FOAuthStackExchangeCallback
The response is an HTTP 400 with the error.
Comparing the redirect_uri
strings:
http%3A%2F%2Fwww.noverse.com%2FOAuthStackExchangeCallback http%3A%2F%2Fwww.noverse.com%2FOAuthStackExchangeCallback
They match.
Supporting Data
- Using the GTMOauth2 library by Google
- Application ID is
218
- Client Side OAuth is turned off (so I do see the redirect in the browser)
- The domain name is
noverse.com
Code
The code is from the example in the library
The Authenticator Object
This is the object that is used to get the token and to make further secured requests
- (GTMOAuth2Authentication *)authForStackExchange
{
NSURL *tokenURL = [NSURL URLWithString:@"https://stackexchange.com/oauth/access_token"];
NSString *redirectURI = @"http://www.noverse.com/OAuthStackExchangeCallback";
// ... snip ...
GTMOAuth2Authentication *auth;
auth = [GTMOAuth2Authentication authenticationWithServiceProvider:@"StackExchange" tokenURL:tokenURL redirectURI:redirectURI clientID:clientID clientSecret:clientSecret];
return auth;
}
Login to StackExchange
This code starts the process by launching a web browser to enable login and authorization. It intercepts the redirect_uri
and then uses the previous object to request the token.
- (void)signInToStackExchange
{
GTMOAuth2Authentication *auth = [self authForStackExchange];
auth.scope = @"";
// display the authentication sheet
NSURL *authURL = [NSURL URLWithString:@"https://stackexchange.com/oauth"];
GTMOAuth2WindowController *windowController;
windowController = [GTMOAuth2WindowController controllerWithAuthentication:auth authorizationURL:authURL keychainItemName:kStackExchangeKeychainItemName resourceBundle:nil];
[windowController signInSheetModalForWindow:self.window delegate:self finishedSelector:@selector(windowController:finishedWithAuth:error:)];
}
access_token
call, but I'll drill further in my code before calling it a bug. Thank you Kevin. – Hiltmon Apr 4 '12 at 21:24access_token
call returnsaccess_token=oHU0MqQMKhC4bcFM6b7HxQ))&expires=86400
. Brilliant!. According to the Google library code (and other OAuth2 servers I am testing), should theexpires
field not beexpires_in
? – Hiltmon Apr 4 '12 at 22:09expires
). Technically,expires_in
is only recommended in the current OAuth 2.0 draft (tools.ietf.org/html/draft-ietf-oauth-v2-25#section-5.1); I believe the whole server response has undergone significant change over various drafts. – Kevin Montrose♦ Apr 4 '12 at 22:22