You might see that the Dropbox Community team have been busy working on some major updates to the Community itself! So, here is some info on what’s changed, what’s staying the same and what you can expect from the Dropbox Community overall.
Forum Discussion
codeVerifier not initialized in dbx.auth.getAccessTokenFromCode
Hi!
I am setting up Dropbox OAuth in an Electron app, and I got the part with generating a redirect URL, opening it in a browser window and letting the user log in working. I can then successfully listen for the redict, but when attempting to get the access token:
const dbx = new Dropbox({ clientId: CLIENT_ID, fetch: fetch });
const tokenResult = await dbx.auth.getAccessTokenFromCode(REDIRECT_URI, code);
I get the following error:
Error: You must use PKCE when generating the authorization URL to not include a client secret
Now, I use the option usePKCE in getAuthenticationUrl, so that should not be an issue. But if I look at where the error comes from, there is a check:
if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}
so I suppose that something is not set up correctly here.
Can you give some advice? Thanks!
SosiOne wrote:... But if I look at where the error comes from, there is a check:
if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}so I suppose that something is not set up correctly here.
...
Hi SosiOne,
Yes, exactly - there is something wrong. 🙂 You are probably unaware how PKCE works. Key moment is to avoid a "man in the middle" during authorization. That's why pair of values are generated - code challenge and code verifier. They are passed during first and second step of the process. Only you (your application actually) is aware about values. In such a way the "man in the middle" (potential attacker) cannot stеal the authorization (possible stealed code is unusable, as in your case). The state should be kept during the process, so the values don't get lost, but you're using new object on the second step - for sure your codeVerifier is lost now (it's clear). Probably you don't understand that you have tried to impersonate yourself as attacker unintentionally (even the impersonation is incomplete and that's why consistency check catch it). Even if you pass that check the server will stop you - the value wouldn't match.
Restructure your code, so the client object stay from the start to the end of OAuth flow and use the same object in both steps. 😉
Hope this helps.
SosiOne wrote:... But if I look at where the error comes from, there is a check:
if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}so I suppose that something is not set up correctly here.
...
Hi SosiOne,
Yes, exactly - there is something wrong. 🙂 You are probably unaware how PKCE works. Key moment is to avoid a "man in the middle" during authorization. That's why pair of values are generated - code challenge and code verifier. They are passed during first and second step of the process. Only you (your application actually) is aware about values. In such a way the "man in the middle" (potential attacker) cannot stеal the authorization (possible stealed code is unusable, as in your case). The state should be kept during the process, so the values don't get lost, but you're using new object on the second step - for sure your codeVerifier is lost now (it's clear). Probably you don't understand that you have tried to impersonate yourself as attacker unintentionally (even the impersonation is incomplete and that's why consistency check catch it). Even if you pass that check the server will stop you - the value wouldn't match.
Restructure your code, so the client object stay from the start to the end of OAuth flow and use the same object in both steps. 😉
Hope this helps.
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
