2

I'm attempting to connect to the Dropbox API using OAuth2. I'm using DropNet as the client library and using the Token (implicit grant) flow option. The test code (roughly the same as DropNet.Samples.WinForms) is a simple dialog with an embedded browser control to display the API login page.

The problem I'm seeing is that the API does not redirect the browser to the specified redirect URL (http://localhost). After I provide my credentials and click Allow to grant access, instead of being redirected to localhost I'm redirected to https://www.dropbox.com/1/oauth2/authorize_submit, which fails to load (error 404). There are also no query parameters on the redirected URL. I'm expecting to be redirected to localhost with query parameters containing an authorization code.

For reference the login URL is: https://www.dropbox.com/1/oauth2/authorize?response_type=token&client_id=<blah>&redirect_uri=http://localhost.

Does anyone know what I'm doing wrong? The behavior looks very similar to what's described in: Obtain OAuth2 Access Token for Dropbox Core API with Codenameone's Oauth2 Class, but there's no direct answer there.

6
  • The redirect URI should be specified in the redirect_uri parameter on /oauth2/authorize: dropbox.com/developers/core/docs#oa2-authorize Are you supplying that to /oauth2/authorize?
    – Greg
    Commented Dec 23, 2014 at 0:30
  • Yup, I supplied the redirect URL and verified that it's in the query string to the authorize call.
    – Charlie
    Commented Dec 23, 2014 at 0:35
  • Can you post a sample /authorize URL?
    – Greg
    Commented Dec 23, 2014 at 0:40
  • Thanks for the input - I added the URL to the question. I also noticed that the client library (DropNet) was using api.dropbox.com instead of www.dropbox.com, which I think was also wrong, but that's fixed now.
    – Charlie
    Commented Dec 23, 2014 at 0:52
  • Thanks! The sample looks right. Is JavaScript enabled in the embedded browser? (It needs to be if not.) If it is, are you getting any JavaScript errors in the console?
    – Greg
    Commented Dec 23, 2014 at 0:59

1 Answer 1

1

[edited] I still don't know why it isn't working to use http://localhost as the redirect URL, but I switched to using https://www.dropbox.com/1/oauth2/redirect_receiver as recommended by @Greg, and it works correctly now.

In case it affects other people trying to use the DropNet WinForms sample code, I also had to adjust the code to handle the Navigating and Navigated events in the embedded browser, in addition to DocumentCompleted, because the browser behavior seems to vary by OS and browser version (not a big surprise). The code also needs to be smart enough to stop navigating once it detects the redirect because the browser may continue navigation from that point.

Originally I had fixed it by redirecting to Google, but as @smarks pointed out, this is not a good idea.

4
  • 1
    Glad to hear it's working now, though I believe it should have worked with localhost anyway. If it helps Dropbox does have this page for this purpose: dropbox.com/1/oauth2/redirect_receiver
    – Greg
    Commented Dec 23, 2014 at 1:02
  • Thanks! I didn't know about that redirect_receiver page - that seems like exactly what I want. I'll try with that and see how it works, and update the answer with this info.
    – Charlie
    Commented Dec 23, 2014 at 1:39
  • 1
    "That being said, using Google as the redirect URL might be a bad thing to do, since I'm basically sending them my token. They wouldn't have my API key to use it with, of course, but it still seems iffy." API keys are public knowledge, and you don't need one to use an access token anyway. The actual access token goes in the URL fragment, so it's not sent directly to the target server, but JavaScript on the page could access it, so you're right to consider this a security risk. (redirect_receiver is a good option)
    – user94559
    Commented Dec 23, 2014 at 1:50
  • Thanks for the info @smarx - that makes sense. I'll make sure to call this out in the answer edits.
    – Charlie
    Commented Dec 23, 2014 at 1:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.