C# Dropbox.API File Upload Errors

I think I might have stumbled upon what's going on. First off, I needed to ensure I am enforcing TLS 1.2 throughout my project. Previously it was just defined within the initial OAuth2 form's method. Secondly, I have read on the community posts that the access tokens now have shorter expiration times compared to previously. Strange that just now in 2022 I'm running into that mechanism. Most of the community posts were from a year or more ago where developers ran into this happening.

Between both elements I hope to have things patched up for my project. Time and testing will certainly tell. 😀

Yes, that "Could not create SSL/TLS secure channel" error indicates this is due to a problem establishing the secure connection between your client and the Dropbox API servers. Specifically, Dropbox recently retired support for TLS 1.0 and 1.1. The Dropbox API servers now only support connections using TLS 1.2. You'll need to update your app/network client/environment to use TLS 1.2 in order to continue making Dropbox API calls.

• https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls
• https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client

Additionally, technically unrelated to the TLS issue, Dropbox is in the process of switching to only issuing short-lived access tokens (and optional refresh tokens) instead of long-lived access tokens. You can find more information on this migration here.

Apps can still get long-term access by requesting "offline" access though, in which case the app receives a "refresh token" that can be used to retrieve new short-lived access tokens as needed, without further manual user intervention. You can find more information in the OAuth Guide and authorization documentation.

For reference, while the creation of new long-lived access tokens is now deprecated, we don't currently have a plan to disable existing long-lived access tokens. (If that changes, we will of course announce that ahead of time.) That being the case, you can continue using existing long-lived access token(s) without interruption, if you have any. Also, note though that after the change you won't be able to create new long-lived access tokens.

While the change began on September 30th 2021, we're releasing it gradually, so you may not have seen your app(s) affected until now. Once it applies to your app, it would apply regardless of the "Access token expiration" setting for your app, and that setting may no longer be available for your app.

Thanks for all of the info! Very insightful. Now since I am using the Dropbox.API NuGet package, could you point me to any examples of tokenization using the "new" mechanism that's being rolled out? 

I downloaded the SDK and compiled the OAuthPKCE project. Apparently invoking the HttpListener.Start() method requires elevated privileges. Getting an Error Code: 5 - Access Denied. I'll try to ferret out the logic behind the sample code and implement it outside of the mechanism used in the sample project. Since my client-side app is a basic Click Once deployment that runs at the user level. And our endusers definitely don't have local admin rights to their PC's. 😀  

Also, reviewing the sample projects, it appears as if when a token has expired the routine to acquire a new one is invoking a web browser window in order to complete the OAuth process? So every 4 hours an enduser would be guided through that process, correct? The app I have is used for uploading scanned documents from dedicated endusers. These endusers have the app up all of the workday and are scanning multiple documents. So worst-case a few times a day they would have to run through the OAuth process again? I realize if I just work with the raw API I could likely use static App Authentication (https://www.dropbox.com/developers/reference/auth-types) and forego the entire OAuth process if push came to shove...  

No, when requesting "offline" access, the app receives a "refresh token" that can be used to retrieve new short-lived access tokens whenever, without manual user interaction (that is, the user doesn't need to repeatedly re-authorize the app once the app has the refresh token). The .NET SDK will perform that refresh process (getting new short-lived access tokens) automatically for you.

Okay, I'm making headway recoding my project to account for the new mechanism. I'm hitting a stumbling block trying to perform the second half of the initial OAuth2 process. Taking the code that's supplied in the URI and getting the refresh token. Below is a code snippet. I'm using a WebView2 form to run through the process, since it can run as user-level and doesn't require local admin rights.

The choke point is when my routine hits the ProcessCodeFlowAsync() step. It consistently comes back with an invalid_grant exception. I've run across other posts on here where there were multiple calls going on, and the duplication was leading to this. But I'm only initially hitting this step once, when I first launch my app.

Any suggestions on where to go from here? I do appreciate all of your timely assistance. It's been very helpful!

private async void Start(string appKey, string appPwd)
{
this.ApiKey = appKey;
this.ApiPwd = appPwd;
this.oauth2State = Guid.NewGuid().ToString("N");
var authorizeUri = DropboxOAuth2Helper.GetAuthorizeUri(OAuthResponseType.Code, appKey, new Uri(RedirectUri), state: oauth2State, tokenAccessType: TokenAccessType.Offline);
await this.Browser.EnsureCoreWebView2Async(null);
this.Browser.CoreWebView2.Navigate(authorizeUri.ToString());
this.Visibility = Visibility.Visible;
this.Focus();
}

private void BrowserNavigating(object sender, CoreWebView2NavigationStartingEventArgs e)
{
if (!e.Uri.ToString().StartsWith(RedirectUri, StringComparison.OrdinalIgnoreCase))
{
// we need to ignore all navigation that isn't to the redirect uri.
return;
}

try
{
var uri = new Uri(e.Uri, UriKind.Absolute);
var queryParm = uri.Query;
var code = queryParm.Split('=')[1];
var tokenResult = Task.Run(() => DropboxOAuth2Helper.ProcessCodeFlowAsync(responseUri: uri, appKey: this.ApiKey, appSecret: this.ApiPwd, state: this.oauth2State)).Result;
this.AccessToken = tokenResult.AccessToken;
this.RefreshToken = tokenResult.RefreshToken;
this.UserId = tokenResult.Uid;
this.Result = true;
}
catch (ArgumentException)
{
// There was an error in the code being processed.
}
finally
{
e.Cancel = true;
this.Close();
}
}

An 'invalid_grant' error can indicate that the values you're supplying to ProcessCodeFlowAsync don't match the configuration used with GetAuthorizeUri to get that particular authorization. For instance, I see you're using a redirect URI ('new Uri(RedirectUri)') with GetAuthorizeUri. In that case, you need to supply that same redirect URI to ProcessCodeFlowAsync to validate that request.

That is, in addition to setting the 'responseUri' parameter on ProcessCodeFlowAsync, you should set 'redirectUri' as well (matching the 'redirectUri' value you gave to GetAuthorizeUri).

By the way, I should mention that we don't officially support processing the OAuth app authorization flow in a web view. The OAuth app authorization flow should be processed in the user's system browser. See here for more information. It sounds like we don't have a full sample app that meets your use case exactly, but I have a post here with some information that may be helpful.

That did the trick! I just modified the one line for that second step so it's now below (added the argument in bold italics):

var tokenResult = Task.Run(() => DropboxOAuth2Helper.ProcessCodeFlowAsync(responseUri: uri, appKey: this.ApiKey, appSecret: this.ApiPwd, state: this.oauth2State, redirectUri: RedirectUri)).Result;

Now previously I was only connecting to the API by checking tokens when first launching my app. You're saying my client will automatically pull new access tokens once the old ones expire? So the refresh token remains static and the access token is automatically refreshed?

Here is my code where I instantiate the client when the app first launches. 

DropboxCertHelper.InitializeCertPinning();

DropboxClient client;

var httpClient = new HttpClient(new WebRequestHandler { ReadWriteTimeout = 10 * 1000 })
{
Timeout = TimeSpan.FromMinutes(20)
};

var config = new DropboxClientConfig("DcDocScanner")
{
HttpClient = httpClient
};

config.HttpClient.Timeout = new TimeSpan(0, 5, 0);

client = new DropboxClient(Properties.Settings.Default.AccessToken, Properties.Settings.Default.RefreshToken, Properties.Settings.Default.DropboxApiKey, Properties.Settings.Default.DropboxApiPwd, config);

Great, I'm glad to hear that fixed it.

And yes, the refresh token doesn't change or expire, and can be re-used multiple times. When you pass it to the DropboxClient like this, the client will automatically perform the refresh to get a new short-lived access token whenever needed, without you needing to do anything extra. (Note that just like with long-lived access tokens though, refresh tokens can be revoked on demand by the app or user.)