Child Item

Getting HTTP 401 on for access_token one some server

Hi guys,

We came across a strange issue, when trying to get a access token the the OAuth1 API, the successive calls to "request_token" and "authorize" are working fine, but its is time to access "https://api.dropbox.com/1/oauth/access_token", we receive an Unauthorized/401 response for the POST.

What is the more strange is that the exact same code is used on at least one other server without any issues.

Do you have an idea of what can cause this ? Thanks.

David.

Find more posts tagged with

API

Abuse

Comments

Greg-DB

It's difficult to say off hand. Can you share some sample requests/responses showing the issue in detail? Be sure to redact secret values, but please include the headers/bodies. Thanks in advance!

David S.309

Hi Gregory,

Thanks for your quick response:

We call to:

https://api.dropbox.com/1/oauth/access_token?oauth_consumer_key=sbbviyc3ydrd8n4&amp;oauth_nonce=MTY5MDU3MDQ5MzY1MDk2OTYwMA==&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_timestamp=1452581278&amp;oauth_token=UCrgcXsS1mbVjiKX&amp;oauth_token_secret=YYYYY&amp;oauth_version=1.0&amp;oauth_signature=l0H7LPwqnAwwa1cEDhnJpCr13nQ=

The Request header:

Accept	`text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8`
Accept-Encoding	`gzip, deflate`
Accept-Language	`fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3`
Connection	`keep-alive`
Cookie	`language=fr; _ga=GA1.2.148585141.1451996517; JSESSIONID=19B84D1F6D6592685286D7FF53B5071F`
DNT	`1`
Host	`ocrqa.iriscloud.irislink.com`
Referer	`https://www.dropbox.com`
User-Agent	`Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0`

The Response header:

Connection	`close`
Content-Language	`fr`
Content-Length	`4241`
Content-Type	`text/html;charset=utf-8`
Date	`Tue, 12 Jan 2016 06:47:59 GMT`
Server	`Apache-Coyote/1.1`

As we use a Java servlet to perform POST/GET, the issue arise when post to the URL above when trying to fetch the response:

Small code sample:

URL iurl = new URL(url);

HttpURLConnection uc = null;
uc = (HttpURLConnection) iurl.openConnection(Proxy.NO_PROXY);
uc.setAllowUserInteraction(true);
uc.setInstanceFollowRedirects(true);
uc.setUseCaches(false);
uc.setRequestProperty("Connection", "close");
uc.setRequestProperty("User-Agent", "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)");
uc.setRequestMethod("POST");
uc.setDoOutput(false);
uc.connect();

Is that what you need ?

Br,

David

Greg-DB

A few things to note:

- Are those all of the response headers? E.g., is there a X-Dropbox-Request-Id header?

- What's the response body?

- The response server headers contain unexpected values. E.g., the server header says "Apache-Coyote/1.1", but "nginx" is expected. Is it possible something is interfering with your connection?

- You're using HMAC-SHA1 signing, which can be hard to implement and debug. We highly recommend using PLAINTEXT instead. This blog post may be helpful.

- You're supplying a oauth_token_secret parameter, which isn't expected.

David S.309

Hi,

In fact, we use a Java servlet (in a Apache Tomcat) to perform the call/Authorization flow.

I will look to get the Response Header more precisely. I will also look to use PLAINTEXT instead of HMAC-SHA1. The only things that bothers the team I'm in is that the existing code works flawlessly on at least two other servers.

I will post the response headers field value asap.

Thanks for your time.

David.

David S.309

Hi,

Re-writing the OAuth part to use authorization header (instead of URL parameters) and using PLAINTEXT instead of HMAC-SHA1 for the signature have solved the issue.

Thanks for you time and quick answers !

Br,

David.