Sending mail using Gmail OAuth throwing error: 400 Bad Request - oauth-2.0

I am able to send mails form gmail using oAuth in my application. When i am sending a mail with attachment sized about 6.5 MB getting 400 bad request error.
This works perfectly for mail with small attachment.
Is there any configuration in gmail admin page to set max size of attachment ?
Below is the response i am recieveing:
2016-05-25 04:45:35 ERROR dataPull:219 - sendMail: 400 Bad Request
<HTML>
<HEAD>
<TITLE>Bad Request</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Bad Request</H1>
<H2>Error 400</H2>
</BODY>
</HTML>

You can fix the 400 Bad Request by going to your domain's Admin Console, Manage API client access page under security and add the Client ID from the Developer Console, add the scopes needed for the Gmail API. Check the Delegation domain-wide authority to the service account.
They work well for APIs that dont need a user or when you are using a Google Apps for Work domain and want delegation enabled for all the users in the domain.
As the document stated that If a request result in a new source is syntactically or semantically invalid, the server returns a 400 Bad Request HTTP status code and the source state remains unchanged.
Here's a related SO ticket whcih discuss about 400 Bad Request when sending email: Gmail api Sending email 400 bad request
Regarding the File size limit, Based from the Official Google Documentation, the maximum upload file size is the maximum amount of data you can store within method, you can make upload requests in any of the following ways:
Simple upload [https://developers.google.com/gmail/api/guides/uploads#simple]: uploadType=media. For quick transfer of smaller files, for example, 5 MB or less.
Multipart upload [https://developers.google.com/gmail/api/guides/uploads#multipart]: uploadType=multipart. For quick transfer of smaller files and metadata; transfers the file along with metadata that describes it, all in a single request.
Resumable upload [https://developers.google.com/gmail/api/guides/uploads#resumable]: uploadType=resumable. For reliable transfer, especially important with larger files. With this method, you use a session initiating request, which optionally can include metadata.
Here's a SO ticket asking for size limit of email attachment: Gmail API - size limit batching of emails with attachments?

Related

Frequent timeout errors when returning message to twilio from Microsoft Bot Framework

I've been running into some issues with the twilio and bot framework channel integration.
In a nutshell, a large number of incoming messages and conversations that happen through the twilio channel time out and the user never receives a response. Then, after a few minutes, all the piled up responses will arrive at the same time - almost as iff the responder hangs and then continues. The error occurs only with the twilio channel - the bot it working perfectly when embedded in site, when tested in azure portal, and when connected to slack.
When I first connected twilio to the bot, it was running completely fine for a few days, and now I am getting the following error on roughly 70-80% of the messages which occur through that channel.
On a high level, the error I'm getting specific to the channel is: 'There was an error sending this message to your bot: HTTP status code GatewayTimeout'
Inside of the app logs, the error recording is far more detailed, but still provides no insight into what specifically is causing the error:
HTTP Error 500.1013 - Internal Server Error
The page cannot be displayed because an internal server error has occurred.
Most likely causes:
•IIS received the request; however, an internal error occurred during the processing of the request. The root cause of this error depends on which module handles the request and what was happening in the worker process when this error occurred.
•IIS was not able to access the web.config file for the Web site or application. This can occur if the NTFS permissions are set incorrectly.
•IIS was not able to process configuration for the Web site or application.
•The authenticated user does not have permission to use this DLL.
•The request is mapped to a managed handler but the .NET Extensibility Feature is not installed.
Things you can try:
•Ensure that the NTFS permissions for the web.config file are correct and allow access to the Web server's machine account.
•Check the event logs to see if any additional information was logged.
•Verify the permissions for the DLL.
•Install the .NET Extensibility feature if the request is mapped to a managed handler.
•Create a tracing rule to track failed requests for this HTTP status code. For more information about creating a tracing rule for failed requests, click here.
On the twilio side, I get the following error
Error - 11200
HTTP retrieval failure
Possible Causes
Web server returned a 4xx or 5xx HTTP response to Twilio
Misconfigured Web Server
Network disruptions between Twilio and your web server
No Content-Type header attached to response
Content-Type doesn't match actual content, e.g. an MP3 file that is being served with Content-Type: audio/x-wav, instead of Content-Type: audio/mpeg
Possible Solutions
Double check that your TwiML URL does not return a 4xx or 5xx error
Make certain that the URL does not perform a 302 redirect to an invalid URL
Confirm the URL requested is not protected by HTTP Auth
Make sure your web server allows HTTP POST requests to static resources (if the URL refers to .xml or .html files)
Verify your web server is up and responsive
Check to see that the URL host is not a private or local IP address
Verify the ping times and packet loss between your web server and www.twilio.com
Twilio sends a request to Bot Framework, and gets the following info back
Msg "Bad Gateway"
sourceComponent "14100"
ErrorCode "11200"
EmailNotification "false"
httpResponse "502"
LogLevel "ERROR"
url "https://sms.botframework.com/api/sms"
Twilio was unable to fetch content from: http://sms.botframework.com/api/sms
Error: Total timeout is triggered. Configured tt is 15000ms and we attempted 1 time(s)
Account SID: redacted
SID: redacted
Request ID: redacted
Remote Host: sms.botframework.com
Request Method: POST
Request URI: http://sms.botframework.com/api/sms
URL Fragment: true
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Some additional information:
Bot is working perfectly when embedded in website, when tested in the azure portal, and when connected to slack.
Error seems to occur at the locations in code where await context.sendActivity(messageToReturnToUser) or await dialogContext.beginDialog(this.id) or basically anywhere where we send something back to the user.
After a few minutes, bot framework will send all the piled up messages to the end user and they'll get a chunk of sms messages back to back.
Error cannot be replicated in any other channel or in the bot framework emulator.
Error does not occur with every message. An arbitrary number of messages will go through fine and get responses immediately, but then an arbitrary number of messages will be subject to the delays.
I am using paid twilio numbers, no trial errors happening here!
Has anyone else had this problem? Any input or help would be appreciated!
This issue has been mitigated on the Azure/BotFramework side. If you are still having issues, please let me know.

Desktop application with custom uri schema, "Missing scheme" on token request

I'm writing a desktop application in Delphi and trying to sync it with Google calendar (windows only, win 7 and newer). I've registered a custom uri schema in my system registry, so eu.myapp:test will run my program or pass a message to an already running instance of the program.
I've managed to get the first step of authentication going - I open the default browser, asking the user for permission to modify their calendars, I get the authentication code back into my software without a hitch. The oauth client is registered as an iOS app,
However when I try to request an actual token, the request is denied (400 - Bad request) with the following response body:
{
"error": "invalid_request",
"error_description": "Invalid parameter value for redirect_uri: Missing scheme: eu.myapp",
"error_uri": ""
}
My request body looks like this:
POST /oauth2/v4/token HTTP/1.1
Host: www.googleapis.com
Content-Type: application/x-www-form-urlencoded
code=XXX&
client_id=YYY&
redirect_uri=eu.myapp&
grant_type=authorization_code
According to the documentation, I am supposed to include the redirect URI obtained from the API Console, but I found no such URI there. Found some older answers, but the developer console has apparently been changed since they were given so they are no longer relevant. What am I missing?
Edit: Added some more information
I built a simple nodejs server and put it up with a SSL certificate and nginx, so I could see what actually gets sent across. I then used both my app and the example C# app to send the token request to it and monitor the request body.
The only discernible difference was that delphi url encoded the code automatically (4%2Fhky... instead of 4/Fhky... for example). Other than that they seemed identical.
I also tried rewriting the app to listen to a localhost port but ended up with the same results. There is a delphi demo where they demonstrate the use of google api by using an embedded browser for the user to log in (and it works), but according to the api documentation, it's deprecated and will go away soon. Besides, it seems like I can manage the first redirect just fine, but getting the actual tokens fails.
Found my error. I noticed that the parameters were getting encoded automatically by the delphi component responsible for making the requests. I manually encoded the redirect uri before setting it as a parameter on the token request. Then the component encoded it again, which caused it to be different to the url given on the code request, which caused the uri_mismatch error.
The uris also need to be identical on both requests, as even though the second request does not redirect, it still uses the redirect_uri as a validation parameter.

Rails public/private key authentication, but user has no server

I've built a JavaScript app that's powered by a Rails back-end. The JavaScript app (the built/minified version) is going to live on an S3 bucket.
The app Iv'e built is going to run on other people's websites, similar to Stripe (Stripe has you include this code in your HTML):
<form action="" method="POST">
<script
src="https://checkout.stripe.com/checkout.js" class="stripe-button"
data-key="api_key"
data-amount="999"
data-name="Stripe.com"
data-description="Widget"
data-image="/img/documentation/checkout/marketplace.png"
data-locale="auto">
</script>
</form>
The difference is that my user will have no back-end, it's all handled by my Rails API. The end-user fills out the form on my user's website, and that data is POSTed to my API, not my user's API. My user signs up, posts a snippet with a script to my JavaScript app on their website, and then they have users fill out a form (again, like Stripe) on their website which sends a request to my API.
How can I manage authentication in this circumstance? The key that will be provided in the code snippet is obviously public, given that it's in the HTML on my user's website. How can I verify the request is coming from the correct person given the key? Should I look at IP Address and/or domain name that the request comes from?
Let's pretend your user's website is www.example.com.
You want to know did this request come from the real www.example.com ?
There are two possible solutions :
1- Certificates
If your user's site uses https(it has a certificate) the certificate identifies a unique site(that what it's for), on signup you can request that certificate and add it to your rails trust store, then in your javascript app you send the certificate on every request and your rails verifies it.
advantages
1- no backend needed.
2- more secure than a simple api-key, that's because an api-key could provide authentication but not non-repudiation which the certificate provide.
3-easy for your user(provided they already have a certificate).
disadvantages
1- too secure : you didn't mention that non-repudiation is a goal, if it is this disadvantage doesn't count.
2- might hurt performance : on every request a certificate is posted and verified, not only verifying a certificate is slower than verifying an api-key but sending the certificate on every request may heart bandwidth.
3- requires your user is using https, what if he/she doesn't want to use https for some reason ???
2- Setting a proxy
You store the api-key on the server and don't post it in the snippet and you assemble a simple backend that its only job is to send the api-key (some sort of a proxy).
advantages
1-not too secure : it provides the authentication you want without providing more needless goals.
2- good on performance : yes there is a proxy which may be slower, may be faster but that's faster than verifying a certificate and sending it on every request in my opinion.
3-simpler to program : I think assembling this backend is easier than writing certificate verification code in a Rails app.
4- doesn't require https.
disadvantages
1-more installation for the user : that's because they have to install a backend besides the include snippet.
2-the form data should be sent to this backend and then to your rails backend, so we have two round trips.
Now web servers (Apache,Nginx) can be configured to work as proxies but I don't know if they can be configured to send the api-key too.

Message status updates are going fine on my end, but Twilio reports 502 errors

As far as my server is concerned, the message status updates from recently sent SMS messages are working fine. In the Twilio API, however, it claims that all requests are returning a 502 error with the body:
<html>
<head>
<title>502 Bad Gateway</title>
</head>
<body>
<h1>Bad Gateway</h1>An upstream server returned an invalid response.
</body>
</html>
I've confirmed by placing a filter on outbound traffic both in my application and the firewall that we're returning a blank 200 OK status. Anything that happens between the time I respond and they retrieve the message is completely out of my hands.
Is there anything else that could cause this? Does Twilio interpret non 502 responses as 502 in certain cases?
Twilio developer evangelist here.
I have seen this happening before when I didn't have a Content-Type being returned. Have a look at the information below, and if the problem is not solved after going through the list let me know and we can look at other possible solutions.
If your debugger is reporting a 502 Bad Gateway error, this may mean
that Twilio's internal server had trouble retrieving content from your
website. Your request must contain a Content-Type that is valid.
Twilio may also have had problems resolving your DNS name to an IP
address, or issues with the network connection. Check that your web
server is started, and is available over the public Internet.
Possible Causes
Web server returned a 4xx or 5xx HTTP response to Twilio Misconfigured
Web Server Network disruptions between Twilio and your web server No
Content-Type header attached to response Content-Type doesn't match
actual content, e.g. an MP3 file that is being served with
Content-Type: audio/x-wav, instead of Content-Type: audio/mpeg
Possible Solutions
Double check that your TwiML URL does not return a 4xx or 5xx error
Make certain that the URL does not perform a 302 redirect to an
invalid URL Confirm the URL requested is not protected by HTTP Auth
Make sure your web server allows HTTP POST requests to static
resources (if the URL refers to .xml or .html files) Verify your web
server is up and responsive Check to see that the URL host is not a
private or local IP address Verify the ping times and packet loss
between your web server and www.twilio.com

Is it possible to send a cookie with a SMSMessage using the Twilio-csharp / TwilioRestClient?

I am creating outbound SMS communication and need to set a cookie so I can track the conversation thread. I'm using the Twilio-charp client and did not see a way to set a cookie or and http header. Is this possible or do I need to pursue a different route?
Edit:
I need to elucidate here. In my scenario I need to set a cookie with a transaction id that needs to included in the originating outbound message. For example I will be creating an SMS message that will request a response from the user: "Text (1) to approve, (2) to decline".
The Twilio sample code details a page that receives a message, checks for a cookie, then creates one if it does not already exist. In my scenario I need the cookie to be in the outbound message.
I contacted support at Twilio and they stated that cookies can not be sent with their REST API. Cookies can be exchanged from the response endpoint that you create where you set the http header.
This means that you must wait for the user to reply to your first message before you can insert cookies to the http headers.
You can definitely set a cookie to track the conversation thread. Details and sample code can be found here under Twilio's .NET (C#) quickstarts: http://www.twilio.com/docs/quickstart/csharp/sms/tracking-conversations

Resources