I asked this at <a href="http://stackoverflow.com/questions/25966130/using-hapijs-and-

Can you just check for that query string? <div class="snippet-clipboard-content no

Hi <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="

How to handle the authorize rejection from Twitter? about bell HOT 7 CLOSED

hapijs commented on May 31, 2024

How to handle the authorize rejection from Twitter?

from bell.

Comments (7)

patrickkettner commented on May 31, 2024 1

Sorry for taking so long to reply, @tonyDarriens. Like you found already, the issue is that hapi's event flow processes auth before it gets to the handlers, so you never see query string.

@geek - I went through and got the responses from (nearly) all the providers (yahoo was 500ing at the time). The query response from each of these was as follows

Facebook

{                                                                                 
  "error": "access_denied", 
  "error_code": "200",
  "error_description": "Permissions+error",
  "error_reason": "user_denied",
  "state": "[hash]"
}

Foursquare

{                                                                                 
  "error": "access_denied",                                                       
  "state": "[hash]"                                                               
}

Google

{                                                                                 
  "error": "access_denied",                                                       
  "state": "[hash]"                                                               
}

Github
(Doesn't have a cancel)

Instagram

{                                                                                 
  "error_reason": "user_denied",                                                  
  "error": "access_denied",                                                       
  "error_description": "The+user+denied+your+request.",                           
  "state": "[hash]"                                                               
}

Live

{                                                                                                                                      
  "error": "access_denied",                                                       
  "error_description": "The%20user%20has%20denied%20access%20to%20the%20scope%20requested%20by%20the%20client%20application.",
  "state": "[hash]"                                                               
}

Twitter

{                                                                                 
  "denied": "[hash]"                                                              
}

The common being "error": "accessed_denied", with twitter being and outlier. Is there a way to catch Hapi's auth failure, or should we just Boom it like @tonyDarriens did in his example?

from bell.

patrickkettner commented on May 31, 2024

Can you just check for that query string?

server.route({
    method: ['GET', 'POST'],
    path: '/login',
    config: {
        auth: {
            strategy: 'twitter',
            mode: 'try'
        },
        handler: function (request, reply) {

            if (!request.auth.isAuthenticated || request.query.denied) {
                return reply('Authentication failed due to: ' + request.auth.error.message);
            }

            return reply.redirect('/home');
        }
    }
});

from bell.

commented on May 31, 2024

Hi @patrickkettner , I tried what you said but still redirects. I even put a console.log inside the handler to see what's inside the request object, but it doesn't output anything. This is another reason why I think this has something to do with how the auth strategy handles the route and the request.params.

In the console I can see that it goes to the /login?denied=xxxx and then redirected again to Twitter.
get /login {"denied":"DOjtWJ2uJlGC8vbDc6cWKUraDHW8FQiy"} 302 (692ms)

from bell.

commented on May 31, 2024

Hi @patrickkettner , did you managed to handle this scenario?

I was looking at the code and for now I did this to catch the denied param in the authentication flow.

In bell/lib/oauth.js, before the verification of oauth_token

exports.v1 = function (settings) {

    var client = new internals.Client(settings);

    return function (request, reply) {

        var cookie = settings.cookie;
        var name = settings.name;

        // Sign-in Initialization

        // Verify if app (Twitter) was rejected
        if (name=='twitter' && request.query.denied) {
            return reply(Boom.internal('App was rejected'));
        }

        if (!request.query.oauth_token) {

            // Obtain temporary OAuth credentials

            var oauth_callback = request.server.location(request.path, request);

I guess this is not the best solution but at least I can avoid the redirect bug I was having.

from bell.

geek commented on May 31, 2024

I would reject it how @tonyDarriens did... Is this an internal error, a misconfigured app key?

from bell.

patrickkettner commented on May 31, 2024

OK, I'll work in a PR then. This happens if the user hits 'cancel' on the login screen.

from bell.

chmanie commented on May 31, 2024

The same goes for v2 of the protocol. I'm going to write a PR for that.

from bell.

How to handle the authorize rejection from Twitter? about bell HOT 7 CLOSED

Comments (7)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent