Getting HTTP 401 on for access_token one some server

It's difficult to say off hand. Can you share some sample requests/responses showing the issue in detail? Be sure to redact secret values, but please include the headers/bodies. Thanks in advance! 

Hi Gregory,

Thanks for your quick response:

We call to:

https://api.dropbox.com/1/oauth/access_token?oauth_consumer_key=sbbviyc3ydrd8n4&oauth_nonce=MTY5MDU3MDQ5MzY1MDk2OTYwMA==&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1452581278&oauth_token=UCrgcXsS1mbVjiKX&oauth_token_secret=YYYYY&oauth_version=1.0&oauth_signature=l0H7LPwqnAwwa1cEDhnJpCr13nQ%3D

The Request header:

The Response header:

As we use a Java servlet to perform POST/GET, the issue arise when post to the URL above when trying to fetch the response:

Small code sample:

URL iurl = new URL(url);

HttpURLConnection uc = null;
uc = (HttpURLConnection) iurl.openConnection(Proxy.NO_PROXY);
uc.setAllowUserInteraction(true);
uc.setInstanceFollowRedirects(true);
uc.setUseCaches(false);
uc.setRequestProperty("Connection", "close");
uc.setRequestProperty("User-Agent", "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)");
uc.setRequestMethod("POST");
uc.setDoOutput(false);
 uc.connect();

Is that what you need ?

Br,

David

A few things to note:

- Are those all of the response headers? E.g., is there a X-Dropbox-Request-Id header?

- What's the response body?

- The response server headers contain unexpected values. E.g., the server header says "Apache-Coyote/1.1", but "nginx" is expected. Is it possible something is interfering with your connection?

- You're using HMAC-SHA1 signing, which can be hard to implement and debug. We highly recommend using PLAINTEXT instead. This blog post may be helpful.

- You're supplying a oauth_token_secret parameter, which isn't expected.

Hi,

In fact, we use a Java servlet (in a Apache Tomcat) to perform the call/Authorization flow.

I will look to get the Response Header more precisely. I will also look to use PLAINTEXT instead of HMAC-SHA1. The only things that bothers the team I'm in is that the existing code works flawlessly on at least two other servers.

I will post the response headers field value asap.

Thanks for your time.

David.

Hi,

Re-writing the OAuth part to use authorization header (instead of URL parameters) and using PLAINTEXT instead of HMAC-SHA1 for the signature have solved the issue.

Thanks for you time and quick answers !

Br,

David.