1

Following the Stack Apps documentation Authentication (explicit) section I crafted this AJAX call

        $.ajax({
            url:"https://stackexchange.com/oauth/access_token",
            type:"POST",
            data: {
                client_id: myClientID,
                client_secret: myClientSecret,
                code: getUrlParameter("code"),
                redirect_uri: "https://myapp.com/sameAsBefore" 
            },
            success: function(data){
                console.log(data);
            }
        });

However, this is not accepted.

XMLHttpRequest cannot load https://stackexchange.com/oauth/access_token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://myapp.com' is therefore not allowed access.

I tried removing the contentType and dataType as they will default to application/x-www-form-urlencoded and a best guess for the returning data. No change if they are there or not.

Any ideas what I am missing?

2

The question is not clear enough.
You appear to be trying to use jQuery to do explicit OAuth from a web page. If so, this is not allowed.

Explicit OAuth is for servers. You are not running that code in node.js are you?

Anything that runs in the user's browser, like javascript, needs to use "implicit" (Client side) OAuth. Implicit OAuth was developed for that purpose.

This answer gives the setup and steps needed to use the implicit (Client side) OAuth flow.

This answer gives working code to implement implicit OAuth in a userscript, if you are trying to do that. (Not the same as a web page's javascript.)



If you have your own server, and control the webpage(s), then you would use explicit OAuth. But you need to do it properly (no client-side AJAX for the OAuth bits). That includes: when your server POSTS to stackexchange.com/oauth/access_token it must do it as though it is browsing that page.

  • I had this plan of testing it out with JS before moving it all to PHP, where it should be OK to use the explicit method. Agreed very unclear and bad idea. Will send request from PHP with guzzle instead. – Anders Jun 15 '17 at 5:30
  • 1
    Oops! Didn't mean to step on your suggested edit; didn't see it until after I noticed that typo. Sorry. – Brock Adams Jun 15 '17 at 5:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .