This is in regards to my userscript Bulk flag comments. I am sure I have not at all updated the userscript since the first release of June 24, and I am sure I was able to register for an access token last month.

However, today, I can no longer get the redirect_uri to work. I get an error: 'stackapps.com/a/7936' is not a valid uri. I pushed an update to set the redirect_uri to https://stackapps.com/a/7936. However, after that update it just redirects to the corresponding StackApps page without any accesstokens in the query parameters.

So, has the SE API changed recently? If it hasn't, what am I doing wrong?


There have been no reported changes to the API, officially for many years, (unofficially since January).

But, frankly that script's approach should have never worked. OAuth credentials are sent to:
    https://stackapps.com/a/7936#access_token=y6rVASxxxxxxxxxRO2R9Bg)) (for example)

But this is immediately 302 redirected to:

So the current script cannot see the access token. (Except maybe on a really bad network/system, but one shouldn't count on such things.)

Anyway, You should never OAuth redirect to a page that is not fully owned and controlled by yourself, and on your server -- unless it is the officially provided URL for client side OAuth.

For the Stack Exchange API, this URL is: https://stackoverflow.com/oauth/login_success.

See this answer on Meta Stack Exchange for framework code and an example of using authentication with a userscript.

Not only is that brittle (as you have discovered), it can also be a major security risk, depending on the page chosen.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .