Don't generate callback_url w/ query string #2
Conversation
Using query_string in the callback_url will create ''redirect_uri mismatch' when trying to fetch the token.
|
+1 @masterkain Any way you're gonna merge this and push to RubyGems.org? I can fork it but them I'm just fracturing this again. I reviewed @cyu's code and it LGTM. My company could also take over maintaining this repo if you want to transfer it to https://github.com/getcommande |
|
cc @fatshotty @Keytwo Any way this can be merged? If you want to transfer to my company's GitHub org, we'd take over maintaining this gem if you want. |
|
@aguynamedben we had problems with this redirect stuff in the past, if you can confirm it's working ok with recent gems versions I'll fix the conflict and merge. cheers |
Unlike most providers, the Dropbox Business (and Dropbox consumer) API require the callback_url to exactly match what is configured in their web UI, **including any querystring values**. By default, OmniAuth appends any incoming querystrings to the callback_url being sent the the provider. This means that if your app begins auths with something like: /auth/dropbox_oauth2?auth_version=v2, Your callback_url becomes: /auth/dropbox_oauth2/callback?auth_version=v2 This doesn't exact match Dropbox Business' overly strict requirements for this URL: /auth/dropbox_oauth2/callback The fix is for this provider to override callback_url so that the querystring is not appended automatically. There is a long-going disucssion to see whether this should be fixed in omniauth-oauth2 or within each affected provider strategy: omniauth/omniauth-oauth2#93 It's not super clear, but the consensus seems to be that this behavior should be accounted for in the strategy. Here's the similar issue for Dropbox (consumer): icoretech/omniauth-dropbox2#2 Unmerged PR in the consumer library: icoretech/omniauth-dropbox2#2
|
Yeah this is working in production for us. I think there was a mess with some of the omniauth-oauth2 libraries... we have the current ones and this works with it. |
Using query_string in the callback_url will create ''redirect_uri
mismatch' when trying to fetch the token.
https://www.dropboxforum.com/t5/API-support/URI-misatch/td-p/40948