Need help making a postman example

[BenjiFTL]

I usually test in postman to help keep the responses logged since I have to develop in Unreal Engine.

I'm currently having trouble on step two, but I think I need a bit of clarification about the URL encoding.

Step one's POST request hits the endpoint with a successful HTML response with the hidden form. My second GET response gives me the same HTML, almost as if I was making the same POST request from earlier.

Here are my requests for steps one and two respectively.

STEP ONE:

STEP TWO:

Update: I've updated the cookie 'value' to be everything between 'tesla-auth.sid=' and the ';'. Still having the same issue.

As far as encoding goes my method is to create and 86 element random byte array, converting it to SHA256, then converting to BASE64URL. I'm also not sure if this is my problem, or if its the correct order as I've heard many mixed answers, understandably so it's all up in the air and guesswork. Also the body of the request in step two is www-form-encoded.

I get the exact same error in my ue4 environment so I have a hunch my problem is application agnostic. Albeit all the encoding is done in c++ in unreal engine.

If anyone has any input on this that would be greatly appreciated!

[BenjiFTL]

UPDATE: This problem was due to postman auto-redirecting the request. In postman there is a per request setting that needs to be disabled in order to get the 302 response.

[BenjiFTL]

Although redirecting is one of the issues, my "Location" header doesn't have the proper redirect url, it's simply sending back my POST url from step one

[hardont943]

I have this problem too,it's sending back my POST url and 'login_hint'

[BenjiFTL]

I still have this issue, if I end up finding a solution I will post here.

[hardont943]

thanks!

[wyk111wyk]

I also stuck here, always having the same url I request.

[hardont943]

`public class TeslaTest {
static final String IDENTITY = "email";
static final String CREDENTIAL = "password";

public static void main(String[] args) {
    System.out.println("----------生成随机参数-----------");

    String codeVerifier = RandomUtil.randomString(86);
    String codeChallenge = toCodeChallenge(codeVerifier);
    String state = RandomUtil.randomString(20);

    System.out.println("codeVerifier: " + codeVerifier);
    System.out.println("codeChallenge: " + codeChallenge);
    System.out.println("state: " + state);

    //step1 get hidden form
    System.out.println("----------获取表格参数-----------");
    String url = "https://auth.tesla.com/oauth2/v3/authorize?client_id=ownerapi&code_challenge=" + codeChallenge +
            "&code_challenge_method=S256&redirect_uri=https://auth.tesla.com/void/callback&response_type=code&scope=openid%20email%20offline_access&state=" + state;
    HttpResponse execute = HttpUtil.createGet(url).header("User-Agent", "Faraday v1.3.0").execute();
    Map<String, Object> form = parseForm(execute.body());
    System.out.println("----------获取cookie-----------");
    String cookie = getCookie(execute);
    System.out.println("----------step1 cookie:" + cookie + "-----------");

    //step2 post hidden form data
    String step2Url = "https://auth.tesla.com/oauth2/v3/authorize?client_id=ownerapi&code_challenge=" + codeChallenge +
            "&code_challenge_method=S256&redirect_uri=https://auth.tesla.com/void/callback&response_type=code&scope=openid%20email%20offline_access&state=" + state;
    HashMap<String, String> step2Headers = new HashMap<>();
    step2Headers.put("Cookie", cookie);
    step2Headers.put("User-Agent", "Faraday v1.3.0");
    HttpUtil.createPost(step2Url).form(form).addHeaders(step2Headers).setFollowRedirects(false).execute();


    //step3 get hidden form again(uri add login_hint)
    String step3Url = "https://auth.tesla.cn/oauth2/v3/authorize?client_id=ownerapi&code_challenge=" + codeChallenge +
            "&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fauth.tesla.com%2Fvoid%2Fcallback&response_type=code&scope=openid+email+offline_access&state=" + state + "&login_hint=" + IDENTITY;
    HttpResponse step3Execute = HttpUtil.createGet(step3Url).header("User-Agent", "Faraday v1.3.0").setFollowRedirects(false).execute();
    String step3Cookie = getCookie(step3Execute);
    Map<String, Object> step3Form = parseForm(step3Execute.body());
    System.out.println("----------step3 cookie:" + step3Cookie + "-----------");
    System.out.println("----------step3 form:" + step3Form + "-----------");

    //step4 post hidden form again(uri add login_hint) it can get the code
    HashMap<String, String> step4Headers = new HashMap<>();
    step4Headers.put("User-Agent", "Faraday v1.3.0");
    step4Headers.put("Cookie", step3Cookie);
    String step4Url = "https://auth.tesla.cn/oauth2/v3/authorize?client_id=ownerapi&code_challenge=" + codeChallenge +
            "&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fauth.tesla.com%2Fvoid%2Fcallback&response_type=code&scope=openid+email+offline_access&state=" + state + "&login_hint=" + IDENTITY;
    HttpResponse step4Execute = HttpUtil.createPost(step4Url).form(step3Form).addHeaders(step4Headers).setFollowRedirects(false).execute();

    List<String> location = step4Execute.headers().get("Location");
    String code = location.get(0).split("\\?")[1].split("&")[0].split("=")[1];

    //step5 use the code to get access token
    HashMap<String, String> step5Headers = new HashMap<>();
    step5Headers.put("User-Agent", "Faraday v1.3.0");
    Map<String, Object> step5Form = new HashMap<>();
    step5Form.put("grant_type", "authorization_code");
    step5Form.put("client_id", "ownerapi");
    step5Form.put("code", code);
    step5Form.put("code_verifier", codeVerifier);
    step5Form.put("redirect_uri", "https://auth.tesla.com/void/callback");

    HttpResponse step5Execute = HttpUtil.createPost("https://auth.tesla.cn/oauth2/v3/token").addHeaders(step5Headers).form(step5Form).execute();
    String body = step5Execute.body();
    JSON step5Json = JSONUtil.parse(body);
    String ssoAccessToken = step5Json.getByPath("access_token").toString();
    String ssoRefreshToken = step5Json.getByPath("refresh_token").toString();
    String ssoIdToken = step5Json.getByPath("id_token").toString();
    String ssoExpiresIn = step5Json.getByPath("expires_in").toString();
    System.out.println("----------get the sso access token success!-----------");
    System.out.println("ssoAccessToken: " + ssoAccessToken);
    System.out.println("ssoRefreshToken: " + ssoRefreshToken);
    System.out.println("ssoIdToken: " + ssoIdToken);
    System.out.println("ssoExpiresIn: " + ssoExpiresIn);

    //step6 use oauth token to get vehicle access token
    HashMap<String, String> step6Headers = new HashMap<>();
    step6Headers.put("User-Agent", "Faraday v1.3.0");
    step6Headers.put("Authorization", "Bearer " + ssoAccessToken);
    Map<String, Object> step6Form = new HashMap<>();
    step6Form.put("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
    step6Form.put("client_id", "81527cff06843c8634fdc09e8ac0abefb46ac849f38fe1e431c2ef2106796384");
    step6Form.put("client_secret", "c7257eb71a564034f9419ee651c7d0e5f7aa6bfbd18bafb5c5c033b093bb2fa3");
    HttpResponse step6Execute = HttpUtil.createPost("https://owner-api.teslamotors.com/oauth/token").addHeaders(step6Headers).form(step6Form).execute();
    String step6Body = step6Execute.body();
    JSON step6Json = JSONUtil.parse(step6Body);
    String accessToken = step6Json.getByPath("access_token").toString();
    String refreshToken = step6Json.getByPath("refresh_token").toString();
    String expiresIn = step6Json.getByPath("expires_in").toString();
    System.out.println("----------get the access token success!-----------");
    System.out.println("accessToken: " + accessToken);
    System.out.println("refreshToken: " + refreshToken);
    System.out.println("expiresIn: " + expiresIn);

}

private static String toCodeChallenge(String codeVerifier) {
    Digester digester = new Digester(DigestAlgorithm.SHA256);
    //sha256加密
    String sha256 = digester.digestHex(codeVerifier);
    //base64加密
    return Base64.encode(sha256);
}

private static String getCookie(HttpResponse execute) {
    List<String> list = execute.headers().get("Set-Cookie");
    String cookie = "";
    if (list.size() == 0) {
        throw new RuntimeException("出现异常,没有cookie!");
    }
    for (String str : list) {
        if (str.contains("tesla-auth.sid")) {
            cookie = str.split(";")[0];
        }
    }
    return cookie;
}

private static HashMap<String, Object> parseForm(String body) {
    Document document = Jsoup.parse(body);
    Elements inputs = document.select("input[type=hidden]");
    HashMap<String, Object> map = new HashMap<>();
    if (inputs.size() == 0) {
        System.out.println(body);
        throw new RuntimeException("出现异常!获取隐藏表单失败");
    }
    for (Element element : inputs) {
        String name = element.attr("name");
        String value = element.attr("value");
        map.put(name, value);
    }
    map.put("identity", IDENTITY);
    map.put("credential", CREDENTIAL);
    return map;
}

}
`
it can get the accesstoken

[hardont943]

I've updated the code. it really needs to repeat the request twice to get the code successfully.I have passed the test in Java

[hardont943]

I have uploaded a Java Maven project, you can refer to it
https://github.com/hardont943/tesla-oauth-v3

[wyk111wyk]

我用swift写了一整套你的逻辑，不过还是获取不到code，有时候Location返回我的请求url，有时候就是hint+email，太奇怪了。

[hardont943]

你可以拿着step2的url 去浏览器debug一下 第一遍登录是没有反映的 只会跳回登陆前的页面 但是他加了个hintemail 再继续登录一遍 他会再发一个post的请求 返回就会有code

[BenjiFTL]

you can Input the step2Url in browser and do login,it will send two requests,and then it will redirect to the step2Url and the url add 'login_hint'. and then use the new url to repeat get&post ,you will get the code

Can you clarify what you are doing for step two instead of what's in the docs?