Constantly getting `redirect_uri_mismatch`

[jonathansimmons]

I'm getting a redirect_uri_mismatch when trying to authenticate with box.

my redirect_url is: https://localhost:3000/users/callback
I've also tried: http://localhost:3000/users/auth/box_oauth2/callback

I was aware of an issue omniauth/omniauth-oauth2#81 where there is a an issue with the 1.4.0 version of omniauth-oauth2 but even after forking and locking the gemspec to 1.3.1 I am still getting redirect_uri_mismatch.

Any idea how I can resolve this?

[pramodshinde]

@jonathansimmons Sorry for late reply, are you still facing this issue or you were able to resolve this?

[jonathansimmons]

I resolved the issue but explicitly declaring gem "omniauth-oauth2", "1.3.1" I'm sure that issue I linked is the problem. The omniauth team seems to not care about fixing the issue.

Which would mean you'd need to patch it in your strategy. ¯_(ツ)_/¯

[aguynamedben]

IMO this behavior should be fixed in Omniauth. I'm surprised Omniauth even has callback_url... I figured omniauth-oauth2 would be the place callback_url is generated.

Here's how we're dealing with it

config/initializers/omniauth_callback_url_overrides.rb

# Omniauth appends query parameters to the callback_url.
# https://github.com/omniauth/omniauth/blob/a62d36b3f847e0e55b077790112e96950c35085a/lib/omniauth/strategy.rb#L497
# (note `+ query_string`)
#
# Some 3rd party providers have strict requirements that the callback_url
# exactly match what's in their developer dashboard.
#
# This is an "ecosystem" problem that has been worked-around in many strategies,
# but we're chosing to house all of our workarounds here, rather than to
# fork/patch every OmniAuth strategy affected by this "gotcha".

class OmniAuth::Strategies::BoxOauth2
  def callback_url
    full_host + script_name + callback_path
  end
end

# Fixed in the strategy for:

# Dropbox
# https://github.com/icoretech/omniauth-dropbox2/pull/2/files#diff-e748552830b77123a7be4acdf4b124b505f106ef2b42ff6c191a420ac7ac6fd1R45

# Probably a few other strategies have this (?)

# Threads of people complaining about this:
# https://github.com/omniauth/omniauth-oauth2/issues/93
# https://github.com/omniauth/omniauth-oauth2/issues/81#issuecomment-231442739
# https://github.com/pramodshinde/omniauth-box-oauth2/issues/1
# https://github.com/omniauth/omniauth/issues/975

Let me know if you have a cleaner solution. This strategy could (should?) be patched to "workaround" this problem, but I do think the root cause of the problem is an Omniauth design issue and incompatibility with stricter 3rd party API requirements around callback URLs.

[bradleymarques]

Sorry to necro this thread, but please see #2