Child Item

Possible API v2 bug on revoking token

I am using the java sdk example and I noticed that when revoking the token via https://www.dropbox.com/account#security the example is stuck with an error.

This is because it continues to use the old access token.

Because of that I added code to clear the token on error.
So that a new login is offered.

The new login, provides a NEW access token and the app shows
again in account#security BUT the new token does not work.

All requests end with the error:
{"error_summary": "invalid_access_token/.", "error": {".tag": "invalid_access_token"}}

Find more posts tagged with

API

Abuse

Comments

Greg-DB

Hi Holger, that error should only occur if the API call was made with an invalid or revoked access token. Are you sure you're using a new and valid one? If so, can you share the modified code you're using? Thanks in advance!

Holger K.

I made the following changes to the example:

Every:

"An error has occurred"

changed to

"An error has occurred: " + e.getMessage()

In UserActivitiy.java I changed loadData to

protected void loadData() {
new GetCurrentAccountTask(DropboxClientFactory.getClient(), new GetCurrentAccountTask.Callback() {
@Override
public void onComplete(FullAccount result) {
((TextView) findViewById(R.id.email_text)).setText(result.getEmail());
((TextView) findViewById(R.id.name_text)).setText(result.getName().getDisplayName());
((TextView) findViewById(R.id.type_text)).setText(result.getAccountType().name());
}

@Override
public void onError(Exception e) {
Log.e(getClass().getName(), "Failed to get account details.", e);

SharedPreferences prefs = getSharedPreferences("dropbox-sample", MODE_PRIVATE);
prefs.edit().putString("access-token", null).apply();

}
}).execute();
}

Greg-DB

Your additional code throws away the old stored access token, but it doesn't show how/when you send the user back through the auth flow. Also, I can't reproduce the error once I authorize the app again and get a new access token. Are you sure you're not just using the old access token left in memory?

Holger K.

The new access token is obtained by the original code.

I just need to authorize again I get a new access token (the value changes in the debugger)

When trying to use it, it says the token is invalid.

Greg-DB

Thanks, I can't seem to reproduce that behavior though. Perhaps you can add some logging and then share the log showing the issue? Since this requires checking the access token though, you may want to register an app folder app, or an extra account, so that you can share the log without leaking anything sensitive. (You can also share it privately here if you'd like: https://www.dropbox.com/developers/contact )

Holger K.

I will see what I can do, but one question upfront:

Is it possible that

DropboxClientFactory.init(accessToken);

caches the accessToken somehow as long the app is in memory?

Greg-DB

You can find the implementation of DropboxClientFactory here:

https://github.com/dropbox/dropbox-sdk-java/blob/f43597140fd8349c76f4e76e868d5846f0d3942b/examples/android/src/main/java/com/dropbox/core/examples/android/DropboxClientFactory.java

It looks like it does only create the client when sDbxClient == null, so you may just be re-using an old client with an old access token, e.g., if you didn't restart the app.

Holger K.

Doing some more tests it turns out the issue originates from there.

It would be good that you update your sample so that it creates a new client in case the token has changed.