Child Item

codeVerifier not initialized in dbx.auth.getAccessTokenFromCode

Hi!

I am setting up Dropbox OAuth in an Electron app, and I got the part with generating a redirect URL, opening it in a browser window and letting the user log in working. I can then successfully listen for the redict, but when attempting to get the access token:

const dbx = new Dropbox({ clientId: CLIENT_ID, fetch: fetch });
const tokenResult = await dbx.auth.getAccessTokenFromCode(REDIRECT_URI, code);

I get the following error:

Error: You must use PKCE when generating the authorization URL to not include a client secret

Now, I use the option usePKCE in getAuthenticationUrl, so that should not be an issue. But if I look at where the error comes from, there is a check:

if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}

so I suppose that something is not set up correctly here.

Can you give some advice? Thanks!

Find more posts tagged with

API

Abuse

Accepted answers

Здравко

@SosiOne wrote:
... But if I look at where the error comes from, there is a check:

if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}

so I suppose that something is not set up correctly here.
...

Hi @SosiOne,

Yes, exactly - there is something wrong. 🙂 You are probably unaware how PKCE works. Key moment is to avoid a "man in the middle" during authorization. That's why pair of values are generated - code challenge and code verifier. They are passed during first and second step of the process. Only you (your application actually) is aware about values. In such a way the "man in the middle" (potential attacker) cannot stеal the authorization (possible stealed code is unusable, as in your case). The state should be kept during the process, so the values don't get lost, but you're using new object on the second step - for sure your codeVerifier is lost now (it's clear). Probably you don't understand that you have tried to impersonate yourself as attacker unintentionally (even the impersonation is incomplete and that's why consistency check catch it). Even if you pass that check the server will stop you - the value wouldn't match.

Restructure your code, so the client object stay from the start to the end of OAuth flow and use the same object in both steps. 😉

Hope this helps.

All comments

Здравко

@SosiOne wrote:
... But if I look at where the error comes from, there is a check:

if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}

so I suppose that something is not set up correctly here.
...

Hi @SosiOne,

Restructure your code, so the client object stay from the start to the end of OAuth flow and use the same object in both steps. 😉

Hope this helps.

Greg-DB

@SosiOne Здравко is correct; that codeVerifier state needs to be persisted through the flow. You can find examples here:

SosiOne

Thank you! This indeed fixed my problem! 🙂

SosiOne

Thanks for the examples!