Back to OAuth General Discussion YDN SDKs Forum
0

oauth_callback and custom schemes no longer working

Hi.

I built an Android client that uses OAuth to access delicious. All was working well until recently.

Now the call to https://api.login.yahoo.com/oauth/v2/get_request_token fails with a 401 error. It seems that Yahoo no longer allow custom schemes. My callback is set using oauth_callback=dandroid://callback . I use a custom scheme as it allows Android to spot the call back redirect and pass back control to my application.

Please can you advise? Are custom schemes allowed for call backs? If not, why not, and can you suggest alternative solutions? If so, then why is the call to get_request_token suddenly failing.

Thanks

Dave

by
Report Abuse
7 Replies
  • Hi Dave,

    I replied the same in a separate thread. For your convenience, I
    copied it below:

    We don't allow custom scheme as per our security policy, so only
    HTTP/HTTPS URL is allowed. Probably our recent changes to our
    OAuth servers plugged some holes that we left earlier.

    I would suggest you use the following workaround that should work
    with our security policies.

    - Register your application as Web-based and have your domain verified,
    say mysite.com

    - Use the standard Web flow to get request token and have oauth_callback
    URL to be something like http://mysite.com/oauth

    - Once you get the authorized request token and the verifier in the above
    oauth_callback URL, do another redirect from your Web server to your
    application's custom protocol handler:

    http://mysite.com/oauth?oauth_token=<to...lt;verifier>
    =>
    mycoolapp://mysite.com/oauth?oauth_token=<token>&oauth_verifier=<verifier>

    - Then your application should be able to use the request token and verifier
    to get the access token and then use it to call the Yahoo! APIs.

    I know this means extra work for you, however it will ensure that your
    application will work with our security policies. Also if your site can
    proxy OAuth requests for your applications, then you don't need to embed
    the consumer secret in your application that is installed on your users'
    computers.

    Thanks,
    Yu Wang
    Yahoo! Membership Team
    Report Abuse
    0
  • Hi,

    My httprequest looks like this

    https://api.login.yahoo.com/oauth/v2/get_re...hoo%2fAuth.aspx

    but i was getting an 401 exception

    Can Anyone please help with this i was checking from the sitesite itself
    Report Abuse
    0
  • Hi,

    My httprequest looks like this

    https://api.login.yahoo.com/oauth/v2/get_re...hoo%2fAuth.aspx

    but i was getting an 401 exception

    Can Anyone please help with this i was checking from the sitesite itself

    thanx,

    Pruthvi
    Report Abuse
    0
  • Hi Yu.

    Thanks for the response, very much appreciated. Your work around works for me but is a pain I would rather avoid.

    Just one question. Where can I find details such as allowed options for call backs? I could not find it anywhere.

    Thanks.

    Dave
    Report Abuse
    0
  • Hi Dave,

    I know the workaround requires too much work and is not satisfactory
    either.

    It looks like our document doesn't specify the oauth_callback's
    we accept, so I just have to state it here: Only http/https URLs or
    "oob" are accepted. We currently don't allow custom ports either,
    though we might allow it later.

    Thanks,
    Yu
    Report Abuse
    0
  • QUOTE (omiga @ Sep 14 2010, 11:48 AM) <{POST_SNAPBACK}>
    Hi Dave,

    I replied the same in a separate thread. For your convenience, I
    copied it below:

    We don't allow custom scheme as per our security policy, so only
    HTTP/HTTPS URL is allowed. Probably our recent changes to our
    OAuth servers plugged some holes that we left earlier.

    I would suggest you use the following workaround that should work
    with our security policies.

    - Register your application as Web-based and have your domain verified,
    say mysite.com

    - Use the standard Web flow to get request token and have oauth_callback
    URL to be something like http://mysite.com/oauth

    - Once you get the authorized request token and the verifier in the above
    oauth_callback URL, do another redirect from your Web server to your
    application's custom protocol handler:

    http://mysite.com/oauth?oauth_token=<to...lt;verifier>
    =>
    mycoolapp://mysite.com/oauth?oauth_token=<token>&oauth_verifier=<verifier>

    - Then your application should be able to use the request token and verifier
    to get the access token and then use it to call the Yahoo! APIs.

    I know this means extra work for you, however it will ensure that your
    application will work with our security policies. Also if your site can
    proxy OAuth requests for your applications, then you don't need to embed
    the consumer secret in your application that is installed on your users'
    computers.

    Thanks,
    Yu Wang
    Yahoo! Membership Team


    My iPhone app is affected as well. Out of sudden it is no longer working. Is there away we can receive news of such changes in API?
    Report Abuse
    0
  • Hi Yu,

    As suggested, I had created a file http://myclientsite.com/olWfmjo6byyMQD5Uhv.kEg--.html and verified my domain. Every goes fine.

    I am unable to understand the below statment.

    Use the standard Web flow to get request token and have oauth_callback
    URL to be something like http://mysite.com/oauth

    I mean, do i need to create a folder in my domain for oauth or how is that.  Can u please brief in that point.

    Thanks,
    Mukesh Kumar,
    Android Developer Consultant/Freelancer.
    Hyderabad.
    India.
    QUOTE(omiga @ 15 Sep 2010 12:26 AM)
    Hi Dave,

    I know the workaround requires too much work and is not satisfactory
    either.

    It looks like our document doesn't specify the oauth_callback's
    we accept, so I just have to state it here: Only http/https URLs or
    "oob" are accepted. We currently don't allow custom ports either,
    though we might allow it later.

    Thanks,
    Yu
    Report Abuse
    0
Ask a Question

Recent Posts

in OAuth General Discussion YDN SDKs