cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Share your feedback on the Document Scanning Experience in the Dropbox App right here.

Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

codeVerifier not initialized in dbx.auth.getAccessTokenFromCode

codeVerifier not initialized in dbx.auth.getAccessTokenFromCode

SosiOne
Explorer | Level 4

Hi!

 

I am setting up Dropbox OAuth in an Electron app, and I got the part with generating a redirect URL, opening it in a browser window and letting the user log in working. I can then successfully listen for the redict, but when attempting to get the access token:

 

const dbx = new Dropbox({ clientId: CLIENT_ID, fetch: fetch });
const tokenResult = await dbx.auth.getAccessTokenFromCode(REDIRECT_URI, code);

 

I get the following error:

 

Error: You must use PKCE when generating the authorization URL to not include a client secret

 

Now, I use the option usePKCE in getAuthenticationUrl, so that should not be an issue. But if I look at where the error comes from, there is a check:

 

if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}

 

so I suppose that something is not set up correctly here.

 

Can you give some advice? Thanks!

1 Accepted Solution

Accepted Solutions

Здравко
Legendary | Level 20

@SosiOne wrote:

... But if I look at where the error comes from, there is a check:

 

if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}

 

so I suppose that something is not set up correctly here.

...


Hi @SosiOne,

Yes, exactly - there is something wrong. :slightly_smiling_face: You are probably unaware how PKCE  works. Key moment is to avoid a "man in the middle" during authorization. That's why pair of values are generated - code challenge and code verifier. They are passed during first and second step of the process. Only you (your application actually) is aware about values. In such a way the "man in the middle" (potential attacker) cannot stеal the authorization (possible stealed code is unusable, as in your case). The state should be kept during the process, so the values don't get lost, but you're using new object on the second step - for sure your codeVerifier is lost now (it's clear). Probably you don't understand that you have tried to impersonate yourself as attacker unintentionally (even the impersonation is incomplete and that's why consistency check catch it). Even if you pass that check the server will stop you - the value wouldn't match.

Restructure your code, so the client object stay from the start to the end of OAuth flow and use the same object in both steps. :winking_face:

Hope this helps.

View solution in original post

4 Replies 4

Здравко
Legendary | Level 20

@SosiOne wrote:

... But if I look at where the error comes from, there is a check:

 

if (!this.codeVerifier) {
throw new Error('You must use PKCE when generating the authorization URL to not include a client secret');
}

 

so I suppose that something is not set up correctly here.

...


Hi @SosiOne,

Yes, exactly - there is something wrong. :slightly_smiling_face: You are probably unaware how PKCE  works. Key moment is to avoid a "man in the middle" during authorization. That's why pair of values are generated - code challenge and code verifier. They are passed during first and second step of the process. Only you (your application actually) is aware about values. In such a way the "man in the middle" (potential attacker) cannot stеal the authorization (possible stealed code is unusable, as in your case). The state should be kept during the process, so the values don't get lost, but you're using new object on the second step - for sure your codeVerifier is lost now (it's clear). Probably you don't understand that you have tried to impersonate yourself as attacker unintentionally (even the impersonation is incomplete and that's why consistency check catch it). Even if you pass that check the server will stop you - the value wouldn't match.

Restructure your code, so the client object stay from the start to the end of OAuth flow and use the same object in both steps. :winking_face:

Hope this helps.

SosiOne
Explorer | Level 4

Thank you! This indeed fixed my problem! :slightly_smiling_face:

SosiOne
Explorer | Level 4

Thanks for the examples!

Need more support?
Who's talking

Top contributors to this post

  • User avatar
    SosiOne Explorer | Level 4
  • User avatar
    Greg-DB Dropbox Staff
  • User avatar
    Здравко Legendary | Level 20
What do Dropbox user levels mean?