Parameter not allowed for this message type: code_challenge_method, how to fix it in nuxt? - vue.js

in Nuxt I have the title error using auth v5. This is my current strategy:
The docs (https://dev.auth.nuxtjs.org/schemes/oauth2#codechallengemethod) says that you can use "plain" or "S256" as an option, I tried both but the error persists.
The only I cant manually get it work is by copy-pasting the oAuth in the url:
https://accounts.google.com/o/oauth2/auth/identifier?protocol=oauth2&response_type=token&client_id=MYCLIENTID&redirect_uri=https%3A%2F%2Flocalhost%3A3005%2Flogin&scope=profile%20email&state=sIpW-W_6h_QwUs0gCDV_o&flowName=GeneralOAuthFlow
Compare that link to the following:
https://accounts.google.com/o/oauth2/auth/identifier?protocol=oauth2&response_type=token&client_id=MYCLIENTID&redirect_uri=https%3A%2F%2Flocalhost%3A3005%2Flogin&scope=profile%20email&state=sIpW-W_6h_QwUs0gCDV_o&code_challenge_method=S256&code_challenge=fnyp2Ray850HEmHEwmoyQtIrPFPpHWBt4nVAz9p5Vxs&flowName=GeneralOAuthFlow
The only difference between the first and second link is that the first one actually works (I can login) and it doesn't have a challenge_method.
The second link doesn't work (it displays the google image above) but if you read the end of the link it has both the code_challenge_method & code_challenge

After many hours of trial and error, the only way to make it work is by setting code_challenge_method to an empty string, like this:
The demo used in the nuxt auth module, does the same thing, they don't use any code_challenge_method with the google strategy
EDIT 10/06/2021
After doing further investigation, it seems that if I only use an empty code_challenge_method (just like the image above), google auth just doesn't seem to work anymore, my bet is that a broken commit was merged here, so in order to fix it I added a new property to my google strategy:
responseType: 'token id_token'
I also created a report for that bug here

I had the same error and this setup has fixed my issues. Note I am using Next-auth but the parameter name is the same except for the naming convention. Set response_type value to code. Setting the response_type value to token will issue an error, so use code instead.

Related

Unable to use the Dialogflow CX REST API

When testing the dialogflow API on postman, I am getting a 404 error even though I have specified the correct URL while providing the correct parameters for the parent values. Authentication is also validated.
Any help would be appreciated.
For references, here's where I tried to retrieve list of environments from my agent Heres a pic of the problem. I have provided variables for the ID values
I am getting the same error for most of the endpoint values. It is however working on the detectIntent one
Nevermind, I got my mistake. I didnt remove the '{parent=}' from the URL, apparantly the curly brackets are part of google's naming convention.

"User is unauthorized" error with sample web viewer app

I'm following the instructions here: https://www.itwinjs.org/learning/tutorials/develop-web-viewer/ to create a sample web viewer app. The doc says to update variable IMJS_CONTEXT_ID which is not in the .env file and doesn't appear with "Show IDs" for my iModel (I have created a github issue for the doc already). I've tried updating the variable IMJS_ITWIN_ID instead with the "iTwin ID" from my iModel. When I start the app I get an error page "An Error Has Occurred: The user is unauthorized. Please provide valid authentication credentials". I have checked the variables IMJS_AUTH_CLIENT_CLIENT_ID, IMJS_AUTH_CLIENT_REDIRECT_URI, IMJS_AUTH_CLIENT_SCOPES, IMJS_ITWIN_ID, IMJS_IMODEL_ID and all appear to be correct. Is there something else I need to configure?
Sorry, the tutorial you're referring to is a bit outdated now. Have you taken a look at https://developer.bentley.com/tutorials/web-application-quick-start/?
In the new #itwin/web-viewer-react templates we renamed IMJS_CONTEXT_ID to IMJS_ITWIN_ID. We also made some changes to the required scopes, you'll need namely imodelaccess:read, imodels:read, and realitydata:read. Please make sure your auth client has the above scopes and you have access to the model. If you still have trouble, feel free to continue the discussion over at https://github.com/iTwin/itwinjs-core/discussions

Drive API Update:

I use the following API call (with a valid key) and it has stopped working for one folder but still works for another. When it doesn't work I get an empty "files": [] response rather than a error. I can see that the update has impacted the folder that doesn't work but I don't understand why as they both look the same. I have tried appending &resourcekey=yyy but it makes no difference.
What can I do to fix the problem in either the Drive UI, the API credentials, or in the API call?
https://www.googleapis.com/drive/v3/files?q=%270B6Gv6UcT0j6HY2VKbzktd2F1Z2M%27+in+parents&spaces=drive&fields=files(mimeType%2Cid%2Cname%2CthumbnailLink%2CimageMediaMetadata%2Cdescription)&key=xxx
Thanks for your help.
Be sure to pass the following HTTP header:
X-Goog-Drive-Resource-Keys
along with your request, and set its value to:
[FOLDER_ID]/[FOLDER_RESOURCE_KEY]

invalid_client in google oauth2

I try to make a web page for youtube video upload, therefore I try to get the client id from google api console, and in the api console it shows something like this:
Client ID: 533832195920.apps.googleusercontent.com
Redirect URIs: http://bobyouku.ap01.aws.af.cm/testyoutube.php
https://developers.google.com/oauthplayground
However when I try to test my account using the following URL:
https://accounts.google.com/o/oauth2/auth?client_id=533832195920.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Fbobyouku.ap01.aws.af.cm%2Ftestyoutube.php&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutube&response_type=code&access_type=offline
It gives out the result of invalid_client. Even when I try it on oauth2 playground, same fail occurs
So anyone knows what's happen?
Set/change your product name, I had this issue until I created a product name as same as project name.
The product name can be set in the Consent screen section of the Google Developers Console for your project. Look under APIs & auth in the left navigation and select Consent screen.
You need also to set your email address in the box above the product name.
After copy values from Google web UI, I had a blank space for:
client_id
secret
And at the BEGINNING and at the END for both.
This happens even when clicking on the "copy" button.
Trim the leading and trailing white space from both the client_id and client_secret. Google's copy button does not do this for you.
Set both the email address and product name fields for the OAuth consent screen.
Setting EMAIL ADDRESS and PRODUCT NAME in the consent screen of Google developer console, solves the error "Error: invalid_client. The OAuth client was not found." for me.
I had .apps.googleusercontent.com twice in my ID.
It was a copy and paste issue "Your ID HERE".apps.googleusercontent.com
invalid_client can also simply means that your client ID and client secret are wrong when you create your Oauth2 object.
in this thread i found my answer.
I went to google console,
generate a new project, made refresh, because in my case after create the page didn't reload
select new project
create a client ID
use it for what you need
thanks guys :D
In my case this turned out to be something else, namely my code used an environment variable that hadn't been set properly (and stupidly wasnt checked by my code). Setting it, recompiling assets, and restarting the app did the trick.
If you follow the documentation, from this page
https://developers.google.com/identity/sign-in/web/sign-in#specify_your_apps_client_id
you'll see
<meta name="google-signin-client_id" content="YOUR_CLIENT_ID.apps.googleusercontent.com">
But it's wrong. It should be
<meta name="google-signin-client_id" content="YOUR_CLIENT_ID">
The issue is that the '.apps.googleusercontent.com' gets added anyway. If you do it like the documentation says, you get '.apps.googleusercontent.com' twice
I solved this by removing unnecessary quotes from my clientID and clientSecret values.
Did the error also report that it was missing an application name? I had this issue until I created a project name (e.g. "Project X") in the project settings dialog.
probably old credentials are invalid
see the answer below
stackoverflow answer
or short names may work
see the answer below
stackoverflow answer
or product name same as project name as answered already
at times one may include extra space in the
check twice this line so that you are redirected to the correct url
I solved my problem with trim :
'google' => [
'client_id' =>trim('client_id),
'client_secret' => trim('client_secret'),
'redirect' => 'http://localhost:8000/login/google/callback',
],
None of the following were my issue - I resolved this by opening an incognito window. Something was obviously being cached somewhere, no amount of changing auth client settings helped and there were never any trailing or leading spaces in config values.
Check your Project name on Google APIs console.
you choose another project you created.
I was same error.
my mistake was choosing diffirent project.
At Credentials
Accept requests from these HTTP referrers (web sites) (Optional)
Use asterisks for wildcards. If you leave this blank, requests will be accepted from any referrer. Be sure to add referrers before using this key in production.
Add . (star dot star) . It work fine for me
I accidentally had a value in the Client Secret part of the URL, but Google Credential does not need a Client Secret for Android OAuth 2 Client IDs. Simply leaving the value blank in the URL did the trick for me.
Steps that worked for me:
Delete credentials that are not working for you
Create new credentials with some NAME
Fill in the same NAME on your OAuth consent screen
Fill in the e-mail address on the OAuth consent screen
The name should be exactly the same.
Another thing to check:
When you install the GoogleAPIs into a .Net app with NuGet, it will inject a new set of dummy values in your *.config file.
Check that any original values are still in place, and remove dummy entries.
Deleting client ID and creating new one a couple of times worked for me.
Mine didn't work because I created it from a button from the documentation. I went again to the project and created another OAuthClientID. It worked. Yes, be careful about the extra spaces on right and left too.
For best results make sure you have the complete details as follows:
{"client_id":"282324738-4labcgdsd4nlh34885s2d34tmi.apps.googleusercontent.com","project_id":"abcd23ss-212808","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://www.googleapis.com/oauth2/v3/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"23452-dfgdfgcdfgfd","redirect_uris":["http://localhost:6900/auth/google/callback"],"javascript_origins":["http://localhost:6900"]}
This data is always available for download as JSON from https://console.developers.google.com/apis/credentials/oauthclient/
If you are in Meteor JS, you have to use clientId instead appId:
Since facebook uses appId and google clientId.
ServiceConfiguration.configurations.upsert({
service: "google"
}, {
$set: {
clientId: process.env.OAUTH_GOOGLE_APP_ID,
loginStyle: "popup",
secret: process.env.OAUTH_GOOGLE_SECRET
}
});
I spent some hours to realize over that.
I wish I had seen this post before, because there are a lot of things I had to find out trial and error. A lot can go wrong with this. Here's another issue I had:
Whe you specify the Authorised Javascript origins or Authorised redirect URIs, make sure to include your domain with and without www. So https://google.com and https://www.google.com
Also I had uploaded an Application logo. Because of that, the consent screen required a review... which takes forever. Don't upload an Application logo, or be very patient.
this could also be because of not using https url.
In other words,this only works with https. It works with http only in localhost
The solution that worked for me was to remove the ' single quotes and remove additional spaces at the end of the client id and secret in the .env file

Facebook App in Page Tab receiving signed_request but missing page data

I have a page tab app that I am hosting. I have both http and https supported. While I receive a signed_request package as expected, after I decode it does not contain page information. That data is simply missing.
I verified that like schemes are being used (https) among facebook, my hosted site and even the 'go between'-- facebook's static page handler.
Also created a new application with page tab support but got the same results-- simply no page information in the signed_request.
Any other causes people can think of?
I add the app to the page tab using this link:
https://www.facebook.com/dialog/pagetab?app_id=176236832519816&next=https://www.intelligantt.com/Facebook/application.html
Here is the page tab I am using (Note: requires permissions):
https://www.facebook.com/pages/School-Auction-Test-2/154869721351873?id=154869721351873&sk=app_176236832519816
Here is the decoded signed_request I am receiving:
{"algorithm":"HMAC-SHA256","code":!REMOVED!,"issued_at":1369384264,"user_id":"1218470256"}
5/25 Update - I thought maybe the canvas app urls didn't match the page tab urls so I spent several hours going through scenarios where they both had a trailing slash or not. Where they both had a trailing ? or not, with query parameters or not.
I also tried changing the 'next' value when creating the page tab to the canvas app url and the page tab url.
No success on either count.
I did read where because I'm seeing the 'code' value in the signed_request it means Facebook either couldn't match my urls or that I'm capturing the second request. However, I given all the URL permutations I went through I believe the urls match. I also subscribed to the 'auth.authResponseChange' which should give me the very first authResponse that should contain the signed_request with page.id in it (but doesn't).
If I had any reputation, I'd add a bounty to this.
Thanks.
I've just spent ~5 hours on this exact same problem and posted a prior answer that was incorrect. Here's the deal:
As you pointed out, signed_request appears to be missing the page data if your tab is implemented in pure javascript as a static html page (with *.htm extension).
I repeated the exact same test, on the exact same page, but wrapped my html page (including js) within a Perl script (with *.cgi extension)... and voila, signed_request has the page info.
Although confusing (and should be better documented as a design choice by Facebook), this may make some sense because it would be impossible to validate the signed_request wholly within Javascript without placing your secretkey within the scope (and therefore revealing it to a potential hacker).
It would be much easier with the PHP SDK, but if you just want to use JavaScript, maybe this will help:
Facebook Registration - Reading the data/signed request with Javascript
Also, you may want to check out this: https://github.com/diulama/js-facebook-signed-request
simply you can't get the full params with the javascript signed_request, use the php sdk to get the full signed_request . and record the values you need into javascript variabls ...
with the php sdk after instanciation ... use the facebook object as following.
$signed_request = $facebook->getSignedRequest();
var_dump($signed_request) ;
this is just to debug but u'll see that the printed array will contain many values that u won't get with js sdk for security reasons.
hope that helped better anyone who would need it, cz it seems this issue takes at the min 3 hours for everyone who runs into.