I'm using Devise gem, omniauth_github and also included omniauth-rails_csrf_protection by suggestions of answers I found here but still get the issue.
I was receiving the Not found. Authentication passthru. and then forced the request to the user_github_omniauth_authorize_path with a :post method and a button_to, and now I'm receiving an alert with 'COULD NOT AUTHENTICATE YOU FROM GITHUB BECAUSE "AUTHENTICITY ERROR".'
Related
I'm implementing Facebook login on a Rails 5 app with Devise and the omniauth-facebook gem and I'm getting the following error:
URL Blocked: This redirect failed because the redirect URI is not whitelisted in the app’s Client OAuth Settings. Make sure Client and Web OAuth Login are on and add all your app domains as Valid OAuth Redirect URIs.
I followed this tutorial: https://medium.com/#trydelight/facebook-authentication-with-devise-5b53d2f664ed
So for the "Valid OAuth Redirect URIs" it works locally with no URIs whitelisted, but for production I added
https://noora.app/users/auth/facebook and https://www.noora.app//users/auth/facebook (the production domain is noora.app). After getting the error I even added 2 more URIs with a / on the end and added noora.app and www.noora.app as domains, but I'm still getting the same error.
The app is on live mode and the login page is at https://noora.app/users/sign_in. Part of the Facebook settings are here:
Any ideas? Config seems good, but maybe someone sees something I don't? Thanks!
You should whitelist your callback url, not the one that has login button:
https://noora.app/users/auth/facebook/callback
I was looking for this answer for hours, the solution for me was:
When I checked the params in facebook error page, it said:
redirect=mydomain/auth/facebook/callback
and not:
redirect=mydomain/users/auth/facebook/callback
So I add the first one to Valid OAuth Redirect URIs, without users, and problem solved!!!
I'm getting the following error using the latest Omniauth Facebook gem:
ERROR -- omniauth: (facebook) Authentication failure! invalid_credentials: OAuth2::Error, :
My credentials are correct and i seem to hit facebook ok but the callback errors out.
Any ideas?
The problem I had was that my app was using an older version of the facebook API.
Omniauth-facebook uses a default API version, in my case 2.4 but my App needed a newer version because that is what it said in my Facebook Developer Console. In my case, all I had to do was to update the omniauth-facebook gem to version 4.0.
If you wish you can set the Facebook API version that you want to use instead of using the default like this (omniauth-facebook docs):
use OmniAuth::Builder do
provider :facebook, ENV['APP_ID'], ENV['APP_SECRET'],
client_options: {
site: 'https://graph.facebook.com/v3.0', # this is the example API version
authorize_url: "https://www.facebook.com/v3.0/dialog/oauth"
}
end
You can check which API verison your app is using by going to your facebook developer console.
You can read more about the omniauth-facebook gem API here:
http://www.rubydoc.info/gems/omniauth-facebook/4.0.0#API_Version
I had the same problem but specifying version didn't help me. I end up passing token_params: { parse: :json } something like below which resolved my issue :
Rails.application.config.middleware.use OmniAuth::Builder do
provider :facebook, Figaro.env.fb_appid, Figaro.env.fb_sec,
{ scope: 'email', token_params: { parse: :json } }
end
I have found the reference #174 comment
If you are not using the gem as a middleware directly and instead configuring your options in config/initializers/devise.rb (like the guide in Devise's wiki suggests), you can solve this issue by adding token_params: { parse: :json } to your config options.
So, in config/initializers/devise.rb:
config.omniauth :facebook, "APP_ID", "APP_SECRET", token_params: { parse: :json }
This problem is explicitly handled in Devise's wiki linked above (see section "If you are seeing something like Could not authenticate you from Facebook because “Invalid credentials”...)
Please try to put as many details as you can, try to be specific about your issue to understand the issue more deeply. It'll help to find out the exact issue and answers.
As you're not specific with your issue. I am putting here my answer which I got after so many tries and research.
MY ERROR
ERROR -- omniauth: (facebook) Authentication failure! invalid_credentials: OAuth2::Error, {"message"=>"Cannot call API for app 67878******** on behalf of user sa97**********", "type"=>"OAuthException", "code"=>200, "fbtrace_id"=>"8987987*********"}:
I was facing the above issue in a case if the Facebook user who is authenticating itself by Signing up with his/her details is only having the mobile number in his Facebook profile and NO EMAIL ID because my app is validating the email id should be present before creating any User object.
Because the same code is working fine with the users having the email id in the profile.
Although the Facebook error should be more specific, which saves the developer time to debug the exact issue.
I am using ruby-on-rails to work with google-adwords-api. Until today my application was successfully working retrieving the information I needed using the API.
Today it stopped working and in the console I see the following warning:
ClientLogin authentication method is now deprecated and will be
removed in the future. Consider migration to OAuth2. See
'https://developers.google.com/accounts/docs/AuthForInstalledApps' for
more details.
And then the following exception is fired:
Authorization failed. Server message: { "error" : "invalid_grant" }
Here are the gems I am using to work with the API:
gem "google-adwords-api", "~> 0.9.3"
gem 'google-api-client'
The adwords_api.yml is:
---
:authentication:
:method: OAUTH2
:oauth2_client_id: ***.apps.googleusercontent.com
:oauth2_client_secret: ***
:oauth2_callback: http://...
:developer_token: ***
:user_agent: ***
:oauth2_token:
:access_token: ***
:refresh_token: ***
:service:
:environment: PRODUCTION
:connection:
:enable_gzip: false
:library:
:log_level: INFO
I checked the link from the warning message but didn't find which changes I should make in my code.
From the call-stack (and also from the settings in the yml above) looks like OATH2 is already used here. I found that a call to https://accounts.google.com/o/oauth2/token is done and the response with status=400 has body { "error" : "invalid_grant" }
Remark: I don't use two steps verification.
Well, in this case the problem was that the the token has been created using a google account which was recently deleted.
Hope this answer will save your time if you face this problem.
I'm trying to make Facebook login with omniauth-facebook in Rails 3.2.9; I have followed the steps of Ryan Bates in http://railscasts.com/episodes/360-facebook-authentication and in this very moment I have the same code.
If I try to login without the Javascript it works (it takes me to Facebook, I grant the permissions, and gets me back to the app successfully), but if I try with the Javascript (for the Facebook popup) it initially shows the popup to login, but then makes a redirect and throws me this error (without asking for the permissions):
Started GET "/auth/facebook/callback" for 127.0.0.1 at 2012-11-16 15:16:03 -0600
(facebook) Callback phase initiated.
(facebook) Authentication failure! invalid_credentials: OmniAuth::Strategies::OAuth2::CallbackError, OmniAuth::Strategies::OAuth2::CallbackError
OmniAuth::Strategies::OAuth2::CallbackError (OmniAuth::Strategies::OAuth2::CallbackError)
This is a very common error; I made the research and tried all the solutions (mostly are from some months ago) but none of them work. This is what I have tried:
Checking the sandbox in Facebook is disable (and I have waited hours for the propagation)
Checking the Site URL to http://localhost:3000/
Checking the App ID and App Secret
Downgrading the omniauth-facebook gem to 1.4, and throws me this error: omniauth-facebook must pass either acodeparameter or a signed request (viasigned_requestparameter or afbsr_XXXcookie)
Downgrade to Rails 3.2.8
What else should I do? (I think the key is in the Javascript, and right now I have the same code of the video, with CoffeeScript). Thanks in advance!
I followed that Railscast just now and managed to get it working. You'll notice people discussing your problem in the comments. Following the links there, I ended up on this issue on Github and this question on StackOverflow.
I recommend updating to 1.6.0 and to 2.0.0 when it finally comes out. In the meantime, make sure you aren't making any of these mistakes:
Defining your app credentials in two different initializers, usually omniauth.rb and devise.rb. source
Having a domain name mismatch between your live site and the site url configured within your facebook application. source
Leaving the facebook application in sandbox mode, so the domain name doesn't match the production one. source
Adding a before_filter :authenticate to the OmniauthCallbacksController or ApplicationController (since OmniauthCallbacksController inherits from ApplicationController). source
Using omniauth-facebook in conjunction with Facebook's client-side flow. source
Messing with the state param.
Solution without downgrading (using 1.5.1 right now) :
https://github.com/intridea/omniauth-oauth2/issues/32 ->
Add this to your provider declaration :
provider :facebook, xxxxxxxxx, yyyyyyyyy, {:provider_ignores_state => true}
I am using omniauth for twitter authentication and any time i try localhost:3000/auth/twittet i get the following error
OAuth::Unauthorized
401 Unauthorized
pls any ideas to this issue cos i cant get it right. I have omniauth in my gem file and followed a screencast by ryab bates and just the first step and i have this issue.
You can fix this by specifying a proper callback URL and set your application type to browser. Try http://localhost:3000/auth/twitter
Also, ensure you're using the correct consumer_key and consumer_secret