OAuth authorization code flow isnt working

Diego_Fernandez · December 27, 2020, 4:38pm

The OAuth authorization code flow isnt working! I made all things who write there in the docs!

https://id.twitch.tv/oauth2/token?client_id=CLIENTID&client_secret=SECRET&code=CODE&grant_type=authorization_code&redirect_uri=http://localhost/connect.php

But the API says 404 Page not Found! PLS Help me

BarryCarlyon · December 27, 2020, 4:39pm

This is step 3 of oAuth

You are supposed to make a HTTP POST request to this URL, your 404 Error suggests you made a HTTP GET request instead

PHP Example: https://github.com/BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/php/index.php#L38
NodeJS Example: https://github.com/BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/nodejs/server.js#L127

Diego_Fernandez · December 27, 2020, 4:53pm

@BarryCarlyon can you tell me what a POST and GET ís? Im new. And whats that? : https://github.com/BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/php/index.php#L38

BarryCarlyon · December 27, 2020, 4:55pm

It’s just different ways for HTTP requests to be made and generally infer that other stuff will happen when you perform a given request

Loosely:

GET will only send “arguments” in the “URL”

POST will do either.

GET’s are repeatable
POST’s generally are not (as different data would be POSTed each time)

POST’s also allow more/other kinds of data to be send other than the limitations of the query string that only GET allows

BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/php/index.php#L38


    session_destroy();
    header('Location: /');

    exit;
} else if (isset($_GET['code']) && $_GET['code']) {
    // we have a code on the address line so lets parse and exchange

    // validate the state/nonce
    if (isset($_SESSION['nonce']) && isset($_GET['state']) && $_SESSION['nonce'] == $_GET['state']) {
        // lets exchange the code for an access token
        $ch = curl_init('https://id.twitch.tv/oauth2/token');
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, array(
            'client_id' => CLIENT_ID,
            'client_secret' => CLIENT_SECRET,
            'code' => $_GET['code'],
            'grant_type' => 'authorization_code',
            'redirect_uri' => REDIRECT_URI
        ));

Is a PHP example

Diego_Fernandez · December 27, 2020, 5:11pm

OK Thanks, but how can I get the code in my url? I mean this: localhost/test.php?code=1224345231356456…

BarryCarlyon · December 27, 2020, 5:13pm

github.com

BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/php/index.php#L44



// validate the state/nonce
if (isset($_SESSION['nonce']) && isset($_GET['state']) && $_SESSION['nonce'] == $_GET['state']) {
    // lets exchange the code for an access token
    $ch = curl_init('https://id.twitch.tv/oauth2/token');
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, array(
        'client_id' => CLIENT_ID,
        'client_secret' => CLIENT_SECRET,
        'code' => $_GET['code'],
        'grant_type' => 'authorization_code',
        'redirect_uri' => REDIRECT_URI
    ));

    // fetch the data
    $r = curl_exec($ch);
    // get the information about the result
    $i = curl_getinfo($ch);
    // close the request
    curl_close($ch);

Query string parameters are found in $_GET

Diego_Fernandez · December 27, 2020, 5:23pm

Notice : Undefined index: code in C:\xampp\htdocs\connect.php on line 10

Line 10: ‘code’ => $_GET[‘code’],

BarryCarlyon · December 27, 2020, 5:24pm

There there is no code to retrieve from the Querystring

A check such as

github.com

BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/php/index.php#L32



        // note: not testing the HTTP response codes,
        // since we don't care too much as logging out
        curl_close($ch);
    }

    session_destroy();
    header('Location: /');

    exit;
} else if (isset($_GET['code']) && $_GET['code']) {
    // we have a code on the address line so lets parse and exchange

    // validate the state/nonce
    if (isset($_SESSION['nonce']) && isset($_GET['state']) && $_SESSION['nonce'] == $_GET['state']) {
        // lets exchange the code for an access token
        $ch = curl_init('https://id.twitch.tv/oauth2/token');
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, array(
            'client_id' => CLIENT_ID,

Will crush the notice

Diego_Fernandez · December 27, 2020, 5:37pm

Yes and wheres now the access key @BarryCarlyon?

BarryCarlyon · December 27, 2020, 5:39pm

Instide the response to the curl request.

It’ll need to be JSON decoded and then you can exract it from the object

My JSON Decode is here

github.com

BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/php/index.php#L57


));

// fetch the data
$r = curl_exec($ch);
// get the information about the result
$i = curl_getinfo($ch);
// close the request
curl_close($ch);

if ($i['http_code'] == 200) {
    $token = json_decode($r);

    // always a good idea to check the JSON parsed correctly
    if (json_last_error() == JSON_ERROR_NONE) {
        // looks good
        $_SESSION['token'] = $token;
        // file_put_contents(__DIR__ . '/auth.json', $r, JSON_PRETTY_PRINT);

        // login is complete
        // now we'll redirect home for the "main" viewer
        // so we can remove the ?code= from the URL

Token is in $token->access_token

Also as shown elsewhere in my example I linked to

Diego_Fernandez · December 27, 2020, 5:49pm

But the http_code isnt 200

BarryCarlyon · December 27, 2020, 5:50pm

Debug your PHP code.

Spit out the response it’ll describe the error

Diego_Fernandez · December 27, 2020, 5:52pm

@BarryCarlyon Recoverable fatal error : Object of class stdClass could not be converted to string in C:\xampp\htdocs\connect.php on line 26 Sorry for my many questions xD

BarryCarlyon · December 27, 2020, 5:53pm

print_r should spit it out