Cannot get redirect_uri to work

Question

This is in regards to my userscript Bulk flag comments. I am sure I have not at all updated the userscript since the first release of June 24, and I am sure I was able to register for an access token last month.

However, today, I can no longer get the redirect_uri to work. I get an error: 'stackapps.com/a/7936' is not a valid uri. I pushed an update to set the redirect_uri to https://stackapps.com/a/7936. However, after that update it just redirects to the corresponding StackApps page without any accesstokens in the query parameters.

So, has the SE API changed recently? If it hasn't, what am I doing wrong?

Answer 1

There have been no reported changes to the API, officially for many years, (unofficially since January).

But, frankly that script's approach should have never worked. OAuth credentials are sent to:
    https://stackapps.com/a/7936#access_token=y6rVASxxxxxxxxxRO2R9Bg)) (for example)

But this is immediately 302 redirected to:
    https://stackapps.com/questions/7935/bulk-flag-comments/7936#7936

So the current script cannot see the access token. ^{_{(Except maybe on a really bad network/system, but one shouldn't count on such things.)}}

Anyway, You should never OAuth redirect to a page that is not fully owned and controlled by yourself, and on your server -- unless it is the officially provided URL for client side OAuth.^‡

For the Stack Exchange API, this URL is: https://stackoverflow.com/oauth/login_success.

See this answer on Meta Stack Exchange for framework code and an example of using authentication with a userscript.

---

^‡ Not only is that brittle (as you have discovered), it can also be a major security risk, depending on the page chosen.