Can't find any way to handle with issue when user disconnects his account manually by going into Settings > General Settings > Connected Apps > Disconnect.
After user has beed disconnected i can catch an error only when trying to get something from his account.
The question is if there are some way to ping/check Xero user's credentials as i'm going to implement something like heartbeat for this case (i did not find any kind of callbacks for this case which may be useful).
Thanks!
Thanks for the question.
At the moment the only solution is for you to make a request and catch the fail result.
I suggest the Organisation endpoint for this.
Related
the last couple of days I implemented the autodiscovery/auth flow for UCWA against Skype for Business Online and AzureAD. When I'm done and having the URL to the application directory (+ the OAuth2 Credentials) I save those into our internal system. So later on I want to create online meetings with this data. The URL to the applications directory looks like this: https:\/\/webpoolam42e10.infra.lync.com\/ucwa\/oauth\/v1\/applications\/101331226048\/onlineMeetings\/myOnlineMeetings
If I do this within the first minutes of retrieving the data it works just fine. But later on it seems, that the application directory is gone. I'm getting this response:
body":"{\"code\":\"NotFound\",\"
subcode\":\"ApplicationNotFound\",\"message\":\"An error occurred. Please retry. If the problem persists, contact your support team.\"}
Status Code is 404.
Later on I even tend to get 401 errors that mean unauthorized.
I suspect the application server going away and only being temporarily available. I got a refresh token and a valid access token, so this wont be a problem. I've got no clue what is going on there and wasnt able to find help in the docs. So maybe one of you got any advice - I'd be really thankful!
Side-Info:
I'm doing all this in PHP and I only have user-interaction at the initial authentication. I save the refresh token and all other things I need, so that my server-side application can use the authorization in long term.
Reporting here part of my reply to another question:
Keeping a UCWA App always online:
If you need to achieve that, you need to understand and implement correctly the concepts explained here me Dashboard, especially at Reporting activity section:
call reportMyActivity every 4 minutes max.
maintain an active P-GET with the Events Channel
handle possible timeouts on the Events Channel
handle possible DELETE events (on the Events Channel) the server can send for the application, for which you'll have to regenerate your app Application dashboard
reporting app's activity, and keeping a valid open P-GET with Events Channel are both very important!
Successfully implemented OAuth flow within Google Actions context via account linking. However, after token expiration, it asks for user to link the account. Is there a configuration in Google Actions for token auto-refresh in this context so that the user is not re-prompted to link account after doing so already?
There are multiple problems with the app, to the point I'm a little surprised it got approved.
The first is that if you're using https://stackoverflow.com/a/44296039/1204142, then you should look at the update which indicates that Google is no longer allowing their endpoints to be used for account linking. This may explain why the card doesn't go away. Since it didn't prompt me for scopes after I authenticated myself... I'm not actually sure what it thinks it's doing.
But some code must have been sent, since the Assistant thinks we're linked. Even if the card doesn't go away.
However, when I connect, it prompts me with
OK, would you like anything else?
for the initial prompt. Which doesn't make sense in this context. But if I say "yes" it says
Sorry, I don't understand what you're asking. Say "help" to know how I can assist you.
If I ask for help, it says
Here's how piggy piggy can help.
and then leaves the mic open without saying anything further.
Your server can send an error code that will tell Google's OAuth server to send a request for a new access token using their refresh token.
We have a site that uses a "one-time" login process for password resets which are not initiated by the user themselves. (for instance, a password reset that is initiated by an admin or another employee) A URL is sent to the user via email which can then be used to reset their password. The URL can only be visited one time. (there's more to this for security-sake but I'll keep it simple) Recently, some users have complained that when they visit the link, it has already expired. The end result is that they can't reset their passwords using this feature. We discovered that the users in question have a spam filter or "link checker" in their environment that they do not have access to. This device visits the one-time link before the user is able to, to make sure its safe.
I'm trying to solve this issue and was wondering if there's a way I can detect these type of devices on the web server when the request is made? When the spam filter visits the link, is there something in the http request that would stand apart from a regular browser? Maybe they all use a specific custom HTTP header? Or maybe there's a regex I could use on the user agent? I haven't been able to catch one of these yet, so I'm not sure what the request looks like coming from a spam filter.
Anyone know of a way to detect spam filters of any vendor by looking at the http requests? I know it's a long shot but maybe they all use a specific header for reasons such as this?
I got approval to modify the design to remove the one-time aspect of the URL. This solves the issue and saves me the headache. Thanks for the suggestion, #PeeHaa
When I am creating General API key on SendGrid its saying access Frobidden, I am not getting what to do, I opened ticket for that, Hope any one knows about this issue.
Please Help me.
Have you tried to log out and log back in and then try creating an API key again? Perhaps your session expired.
Is it possible that this happens because your account is still being provisioned?
In my case, the Multiple User Credentials account was being used. You have to use main account in order to create API keys.
It seems to be common practice to lock user accounts after enough failed attempts in a particular time window.
I am wondering how you prevent denial-of-service attacks since a malicious user who had the username of someone he wished to DoS could simply rapidly make logon attempts.
Is the remedy to lock the account for only the IP address of the user who exceeded the logon attempt count+window ?
Is there any better way?
EDIT:
I don't want to make my users solve a captcha on each login attempt.
You shouldn't block the user by its IP, because maybe it is a real user that forgot his pass and did the retries manually.
The worst thing (business-wise) is that a real user will not be able to access your service.
So, your problem is actually "How do I know that the user is not a robot?".
One of the most popular ways to deal with this is to use a different mechanism for multiple login attempts.
For instance, Google uses Captcha after about 3 trials,
so an automatic bot will get stuck on this stage.
Of course it is possible to get the bot to read the captcha, but it's a start.
You can read more about captcha implementation in their official site: http://www.captcha.net/
Other alternative ideas here: http://econsultancy.com/il/blog/63144-six-alternatives-to-using-the-dreaded-captcha-images