jQuery OAuth API stopped working

prompted by the discussion on antoher thread...

This has stopped working (jQuery/OAuth):

http://dw.diafol.org/en/dw-box/

Although this still works (php/no OAuth):

http://dw.diafol.org/en/dw-badge/

When I start the ball rolling with a click on the jQuery example, I get the authentication box and nothing else. Subsequent clicks bring up the box again.

[pritaeas]

Me too, although I haven't had time to debug yet. It stops after the redirect which returns the code (all I can see so far).

I HATE going back to old code. Even though I sort-of-documented it, it's still a chore.

[pritaeas]

Agreed. Even worse, we were promised nothing would break... ;)

Heh heh. Well whenever there's a change to an API, I steel myself for the fallout.

[Dani]

There was a bug on my end where I changed something and forgot to account for people still doing it the old way (as I had for the serverside implementation).

To comply with standards, the URI http://www.daniweb.com/api/oauth/dialog was changed to http://www.daniweb.com/api/oauth?response_type=token

However, now that I've fixed the bug I accidentally introduced, your app still doesn't work, and I don't understand why :(

[pritaeas]

Hope to provide you with some insights tomorrow.

[Dani]

Nevermind. It's all good. Apparently the reason it didn't work in the first place was all because of a typo.

Nah, still doesn't work. Nevermind

[Dani]

Looks like it works to me?

OK, cleared the cache. It's all good now, thanks.

[Dani]

Glad to hear :) Sorry about that. There was a typo that was precluding my legacy fix from working.

[pritaeas]

This is the response I get from line 28 in the code below:

HTTP/1.1 100 Continue

HTTP/1.1 400 Bad Request
Date: Sun, 08 Dec 2013 10:32:48 GMT
Server: Apache/2.2
X-Powered-By: PHP/5.3.10
Set-Cookie: dani_session=BzFUP1FiDzdZelV5B2gDZAQ0VD1dJFYhBGEEdQIiCGABMlU1CQIHOlFiUiEFOAFwWDpUOARjUT0LKV1sDGcBNARhBmYObFtjVzoGMFFgBmMHZlRkUWAPP1kwVTsHYANmBDxUYl1nVmEEMgQ0AmAIOgFlVTgJZQdlUTVSIQU4AXBYOlQ6BGFRPQspXWcMJwFaBGUGYA45WyhXbgZ7UXYGcAdrVHZRbQ88WTBVMAdwA20EMFQpXTRWagQqBDMCZAgnAW9VaAl%2FB2hRdVI5BTIBM1g6VCkEJFF0C25dfAwIAWQEYwZhDjNbLlcpBjNRZwZoB2BUPlEkDzdZMFU5B2gDdwRoVGZddVYmBFsEZwIyCH0BNFUtCTQHJ1F%2FUiEFOAFqWDpUOgRiUT8LPV06DG4BPQQzBjIOZVthV3gGMlE8BmgHclRwUSQPaFlzVVUHNgM0BHBUZl0kVmkEdwQ8AmEIMwF%2FVXkJZgcu; expires=Tue, 08-Dec-2015 10:32:48 GMT; path=/; domain=www.daniweb.com
Set-Cookie: geolocation=NL; path=/; domain=www.daniweb.com
Set-Cookie: dani_session=VmAFblBjADhXdFB8Uj0GYQY2Bm8IcQN0UDUCcwIiXTVSYQZmBg0EOQMwUiFVaFIjWTtXO1E2VzsEJgBgDTVXZVUwCztQMAxrVWwFOFFgVTJWOQU3UDQAO1c6UDpSNwZkBjEGZghmAzRQZQI4AjJdPlI8Bj4GMwRpAzFSIVVoUiNZO1c5UTRXOwQmADoNJlcMVTQLbVBnDH9VbAV4UXZVI1Y6BSdQbAAzVz5QNVIlBmgGMgZ7CGEDP1B%2BAjUCZF1yUjwGOwZwBGsDJ1I5VWJSYFk7VypRcVdyBGEAIQ0JVzJVMgtsUG0MeVUrBTBRZ1U7VjEFb1AlADhXPlA8Uj0GcgZqBjQIIANzUA8CYQIyXShSZwZ%2BBjsEJAMtUiFVaFI5WTtXOVE3VzkEMgBnDW9Xa1ViCz9QOww2VXoFMVE8VTtWIwUhUCUAZ1d9UFBSYwYxBnIGNAhxAzxQIwI6AmFdZlIsBioGaQQt; expires=Tue, 08-Dec-2015 10:32:48 GMT; path=/; domain=www.daniweb.com
Vary: Accept-Encoding
Content-Length: 1960
Connection: close
Content-Type: text/html; charset=UTF-8

Using this code for a long while:

<?php
session_start();

$clientId = -1;
$clientSecret = '';
$currentUrl = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'];

if (!isset($_GET['code']))
{
    header("Location: http://www.daniweb.com/api/oauth?client_id=$clientId&redirect_uri=" . urlencode($currentUrl));
    exit();
}

$ch = curl_init('http://www.daniweb.com/api/access_token');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_NOBODY, true);
curl_setopt($ch, CURLOPT_HEADER, true);

curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'code' => $_GET['code'],
    'redirect_uri' => $currentUrl,
    'client_id' => $clientId,
    'client_secret' => $clientSecret
));

$result = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($httpCode == 301 or $httpCode == 302) {
    preg_match("@https?://([-\w\.]+)+(:\d+)?(/([\w/_\-\.]*(\?\S+)?)?)?@", $result, $m);
    $targetUrl = $m[0];
    $urlParts = parse_url($targetUrl);
    parse_str($urlParts['query'], $queryParts);
    $token = $queryParts['access_token'];
    $_SESSION['DwApiAccessToken'] =  $token;
    header('Location: http://dwapi.pritaeas.net/');
}
?>

[Dani]

That code should work. Been investigating for like 10 minutes already. Give me another 5 or 10 and then I need to hurry out to a christmas party.

[Dani]

Try changing curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false); to curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); ... Did you change that at any time?

[Dani]

My super apologies!! Bug fixed on my end.

[Dani]

Incidentally, you were getting the 400 error b/c there was actually a 500 error in my code ... Somewhere internally, I ran json_decode() without setting the second parameter to true, and I was trying to fetch its property as if it were an array instead of an object.

[pritaeas]

I set follow to true, but still no go. I get the HTML page for the login page back from curl now. Perhaps my regex is off now, because the header contains the access_token.

See the file. It has Location (redirect) back to my site with the access_token. Probably some change that fails the regex.

[Dani]

Sorry, I'm confused by what you're showing me. You shouldn't have had to change anything. The bug was on my end and I was successfully able to log into your site earlier today.

[pritaeas]

I was successfully able to log into your site earlier today.

Really? I tried just before posting (and now), and still don't get back to my main page. Now I'm confused. How can you login, yet I can't.

K, NOW it works for me. I've changed line 32 above to include HTTP code 200. Apparently I'm getting a 200 even though there's a status 302 in the returned header.

I have the feeling the flow (on my end) is still not entirely correct.

[Dani]

Prit, when you changed the FOLLOWLOCATION option from false to true, you're now no longer returning the original status headers (which would be 302) but you're following them to where they take you and returning the final status headers after the redirect (which would be 200).

[Dani]

Your site doesn't work anymore for me. What did you change??

[pritaeas]

What did you change??

Nothing (only the 200 status check). No clue as to why this is happening, and no time to delve deeper. This morning it worked, now it doesn't.

[Dani]

Did you change the CURLOPT_FOLLOWLOCATION option yesterday? You shouldn't have.

[pritaeas]

It's set to false. I've also removed the 200 check, so the code is exactly as above. Just tried and it worked on the second click of my authorize link.

Closed and re-opened IE, and still worked on the second click. Strange it no longer works on the first. As soon as I get some more time I'll try to figure it out.

[Dani]

Have you had a chance to look into this yet?

[pritaeas]

Not yet. Busy with more important issues unfortunately.