Accessing get_metadata endpoint without Dropbox Javascript package

[milesmajefski]

For fun, I'm making a cataloging web app using asp.net core 2.1 MVC and javascript.  I don't need a frontend framework, so I don't want to bring in the whole NodeJS npm situation into this project.  I'm trying to access https://api.dropboxapi.com/2/files/get_metadata using fetchAPI and Chrome and I am getting this error: 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

Their is a similar question on this forum, and the answer was to use the Dropbox Javascript library.  I thought this API was like any other restful api where all you needed was to send http requests to endpoints.  Is the library required?

Here's all my javascript code.  I am using the chooser to get the id of a folder, then I need to make a call to get_metadata to get the path (why doesn't chooser return the path itself? I guess the folder names are too secret.)

var options = {

    // Required. Called when a user selects an item in the Chooser.
    success: function (files) {
        //alert("Here's the file link: " + files[0].link);
        console.log('files[0]:', files[0]);
        dbxGetPathFromId(files[0]);
    },

    // Optional. Called when the user closes the dialog without selecting a file
    // and does not include any parameters.
    cancel: function () {
        console.log('Canceled');
    },

    // Optional. "preview" (default) is a preview link to the document for sharing,
    // "direct" is an expiring link to download the contents of the file. For more
    // information about link types, see Link types below.
    //linkType: "preview", // or "direct"

    // Optional. A value of false (default) limits selection to a single file, while
    // true enables multiple file selection.
    multiselect: false, // or true

    // Optional. This is a list of file extensions. If specified, the user will
    // only be able to select files with these extensions. You may also specify
    // file types, such as "video" or "images" in the list. For more information,
    // see File types below. By default, all extensions are allowed.
    extensions: ['.NoEmptyFiles'],

    // Optional. A value of false (default) limits selection to files,
    // while true allows the user to select both folders and files.
    // You cannot specify `linkType: "direct"` when using `folderselect: true`.
    folderselect: true, // or true

    // Optional. A limit on the size of each file that may be selected, in bytes.
    // If specified, the user will only be able to select files with size
    // less than or equal to this limit.
    // For the purposes of this option, folders have size zero.
    sizeLimit: 1, // or any positive number
};

var button = Dropbox.createChooseButton(options);
document.getElementById("dropbox-btn").appendChild(button);

function status(response) {
    if (response.status >= 200 && response.status < 300) {
        return Promise.resolve(response);
    } else {
        return Promise.reject(new Error(response.statusText));
    }
}

function json(response) {
    return response.json();
}

function dbxGetPathFromId(file) {
    // do an ajax call to dbx api, print the result
    // post to https://api.dropboxapi.com/2/files/get_metadata with auth
    // use json 
    reqData = {
        "path": file.id
    };
    apiURL = 'https://api.dropboxapi.com/2/files/get_metadata';

    fetch(apiURL, {
        method: 'post',
        headers: {
            "Content-type": "application/json; charset=UTF-8"
        },
        body: reqData,
        credentials: 'include'
    })
        .then(json)
        .then(function (data) {
            console.log('Request succeeded with JSON response', data);
        })
        .catch(function (error) {
            console.log('Request failed', error);
        });
}

[Greg-DB · Accepted solution]

While we recommend using the official libraries, it's not required. You can always call the Dropbox API HTTPS endpoints directly if you prefer. The documentation covers the requirements for each endpoint, and includes an example of calling using curl, e.g., for /2/files/get_metadata.

It looks like you're running in to a CORS issue though, due to your use of `credentials: 'include'`. Dropbox API calls, such as for /2/files/get_metadata, are authenticated using Dropbox API access tokens, not the browser's credentials. You need to supply the access token in the "Authorization" header as a "Bearer" token. (Also, the parameters should be a JSON string in the body.)

So, you code should look more like this:

            fetch(apiURL, {
                method: 'post',
                headers: {
                    "Authorization": "Bearer ACCESS_TOKEN_HERE",
                    "Content-type": "application/json; charset=UTF-8"
                },
                body: JSON.stringify(reqData),
            })

[milesmajefski]

Thank You!  I see that when I make the body parameter a string and make the other changes concerning Authorization, it works.  However I am using the the Access Token that I made manually for my own development purposes.  My new problem is about getting the access token on the server side.  I'll post another question after I have thought about everything some more.  

[Greg-DB]

Great! I'm glad to hear you were able to get that working.

For information on the OAuth app authorization flow, I recommend reviewing the OAuth guide and the authorization documentation.