BadRequest on modified Spring Oauth2 example royclarkson github - oauth-2.0

I have based on the following example in order to create a secure REST Api: https://github.com/royclarkson/spring-rest-service-oauth
The problem is that when I try to get the token I always get Bad Credentials error.
The code is equal, so my guess is that I'm not doing the access token query properly. Following is my curl:
C:\Users\Javier\Desktop\curl\bin>curl -X POST -vu clientapp:123456 http://localhost:8080/wombee/oauth/token -H "Accept: application/json" -d "password=javi&username=javi&grant_type=password&scope=read%20write&client_secret=123456&client_id=clientapp"
Note: Unnecessary use of -X or --request, POST is already inferred.
* Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
* Server auth using Basic with user 'clientapp'
> POST /wombee/oauth/token HTTP/1.1
> Host: localhost:8080
> Authorization: Basic Y2xpZW50YXBwOjEyMzQ1Ng==
> User-Agent: curl/7.47.1
> Accept: application/json
> Content-Length: 107
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 107 out of 107 bytes
< HTTP/1.1 400 PeticiĆ³n incorrecta
< Server: Apache-Coyote/1.1
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< X-Frame-Options: DENY
< Cache-Control: no-store
< Pragma: no-cache
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Fri, 25 Mar 2016 10:52:01 GMT
< Connection: close
<
{"error":"invalid_grant","error_description":"Bad credentials"}* Closing connection 0

Silly me, in CustomUserDetailsService I had getPassword method override with a null, that was my problem.

Related

Kong: kong-spec-expose plugin cannot load the documentation(302 permanently moved)

I have hard times configuring this kong-spec-expose plugin.It is supposed to automatically configure the routes with Swagger. After some time I managed to configure it but when i try to access the documentation of a certain route it is always giving me the 302 permanently moved.So i tested it with curl and here I will leave a link for the kong plugin and a screenshot of the request..
https://docs.konghq.com/hub/optum/kong-spec-expose/
* Trying 127.0.0.1:8000...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8000 (#0)
> GET /api/employee-controller/profile/user/12/base/specz HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Moved Temporarily
< Date: Wed, 11 Jan 2023 09:50:38 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Kong-Response-Latency: 409
< Server: kong/2.8.1
Actually I tried configuring the plugin on multiple routes then on service level but nothing seems to work out.. then tried to analyse where this request is redirected but with no results.

Posting screenshot to rails api with curl

I am trying to post a screenshot via my api to my admin site using curl....I have tried so many different things but nothing is working. I was able to post data using the following command
curl -X POST -d "data[device][test]=test" http://localhost:9000/api/v1/diagnostics -H 'Authorization: Token token="1212"
I know posting an image takes a slightly different approach and i have tried various but still had no joy....I have put some of these below!
curl -X POST -f "filedata[screenshot][test]=#/Users/Desktop/image_test.png" http://localhost:9000/api/v1/diagnostics -H 'Authorization:Token token="1212"'
curl -v -H 'Content-Type: multipart/form-data' -H 'Accept: application/json' -H 'x-api-key:1212' -F "filedata[screenshot][test]=#/Users/Desktop/image_test.png" http://localhost:9000/api/v1/diagnostics
The errors i am getting are 400
* About to connect() to 192.168.33.11 port 80 (#0)
* Trying 192.168.33.11...
* Adding handle: conn: 0x7fcd4b004400
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7fcd4b004400) send_pipe: 1, recv_pipe: 0
* Connected to 192.168.33.11 (192.168.33.11) port 80 (#0)
> POST /api/v1/diagnostics HTTP/1.1
> User-Agent: curl/7.30.0
> Host: 192.168.33.11
> Accept: */*
> Authorization: Token token=1234
> Content-Length: 34655
> Expect: 100-continue
> Content-Type: multipart/form-data; boundary=----------------------------83266d811bad
>
< HTTP/1.1 100 Continue
< HTTP/1.1 400 Bad Request
< Content-Type: application/json; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Status: 400 Bad Request
< X-UA-Compatible: IE=Edge
< Cache-Control: no-cache
< X-Request-Id: 6231c398ff48566500e4aee2f101186b
< X-Runtime: 0.009898
< X-Powered-By: Phusion Passenger 4.0.5
< Date: Tue, 31 Mar 2015 11:09:31 UTC
* Server nginx/1.4.1 + Phusion Passenger 4.0.5 is not blacklisted
< Server: nginx/1.4.1 + Phusion Passenger 4.0.5
* HTTP error before end of send, stop sending
<
* Closing connection 0
log output:
Started POST "/api/v1/diagnostics" for 192.168.33.1 at 2015-03-31 13:14:19 +0000
Processing by Api::V1::DiagnosticsController#create as */*
Parameters: {"filedata"=>{"screenshot"=>{"test"=>#<ActionDispatch::Http::UploadedFile:0x000000059d16d8 #original_filename="image_test.png", #content_type="application/octet-stream", #headers="Content-Disposition: form-data; name=\"filedata[screenshot][test]\"; filename=\"image_test.png\"\r\nContent-Type: application/octet-stream\r\n", #tempfile=#<File:/tmp/RackMultipart20150331-14827-7454c3>>}}}
Filter chain halted as :validate_payload rendered or redirected
Completed 400 Bad Request in 2.9ms (Views: 0.2ms)

HTTP/1.1 401 Unauthorized Error on curl request - heroku

i'm trying to send a request via curl to my heroku based api but i keep getting this error:
* Hostname was NOT found in DNS cache
* Trying 23.21.169.234...
* Connected to helphy-api.herokuapp.com (23.21.169.234) port 80 (#0)
> POST /users/sign_in HTTP/1.1
> User-Agent: curl/7.35.0
> Host: helphy-api.herokuapp.com
> Accept: */*
> Authorization: Bearer d5bd07e4-a1c9-46d2-8d8e-d2a7cbc8501f, Accept: application/json
> Content-Length: 68
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 68 out of 68 bytes
< HTTP/1.1 401 Unauthorized
< Connection: keep-alive
< X-Frame-Options: SAMEORIGIN
< X-Xss-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< Content-Type: */*; charset=utf-8
< Cache-Control: no-cache
< X-Request-Id: 5b615fce-0674-4302-a9b9-f12cb00db754
< X-Runtime: 0.005328
* Server WEBrick/1.3.1 (Ruby/2.0.0/2014-11-13) is not blacklisted
< Server: WEBrick/1.3.1 (Ruby/2.0.0/2014-11-13)
< Date: Fri, 16 Jan 2015 21:10:12 GMT
< Content-Length: 49
< Via: 1.1 vegur
This is my curl request:
curl -v -H "Authorization: Bearer $TUTORIAL_KEY, Accept: application/json" -X POST http://helphy-api.herokuapp.com/users/sign_in -d '{"user": {"email": "xxxxxxx#gmail.com", "password": "xxxxxxx"}}'
UPDATE
this is the log:
2015-01-16T21:43:04.342815+00:00 app[web.1]: Processing by SessionsController#create as */*
2015-01-16T21:43:04.342822+00:00 app[web.1]: Parameters: {"{\"user\": {\"email\": \"xxxxxx#gmail.com\", \"password\": \"xxxxxxx\"}}"=>nil}
2015-01-16T21:43:04.347678+00:00 app[web.1]: Completed 401 Unauthorized in 5ms
updating...done. Updated to 3.23.2
Email and password are correct and chequed, btw.
Your -d parameter should be x-www-form-urlencoded like a query string:
user[email]=email&user[password]=password
If you want to continue using JSON the way you are you have to add the Content-type header to your -H:
Content-type: application/json
This let's the server know to interpret your POST data as JSON rather than a x-www-form-urlencoded string. This is why in the server log the Parameters are coming out like:
Parameters: {"{\"user\": {\"email\": \"xxxxxx#gmail.com\", \"password\": \"xxxxxxx\"}}"=>nil}
That's just a string, not JSON because the server doesn't know you're sending it JSON because you didn't include the Content-type header and by default servers assume POST data is a x-www-form-urlencoded string.

POST request treated as GET in Heroku environment

I have weird case. I have a RoR app, which provides REST API which I'm connecting to from Java application.
I'm developing RoR locally, and deploying it on Heroku environment.
Regardless how (I tried from Java APP, Mozilla REST client, etc.) I try to send POST HTTP request that should be handled by create action in api controller. On localhost - everything is working as expected. On Heroku production env - the POST request is treated as normal GET.
Here are my routes for this resource:
api_v1_items GET /api/v1/items(.:format) api/v1/items#index {:format=>:json}
POST /api/v1/items(.:format) api/v1/items#create {:format=>:json}
api_v1_item GET /api/v1/items/:id(.:format) api/v1/items#show {:format=>:json}
PATCH /api/v1/items/:id(.:format) api/v1/items#update {:format=>:json}
PUT /api/v1/items/:id(.:format) api/v1/items#update {:format=>:json}
DELETE /api/v1/items/:id(.:format) api/v1/items#destroy {:format=>:json}
So I'm trying to do POST request to /api/v1/items passing all necessary parameters.
In localhost the response is correct:
Started POST "/api/v1/items?token=l4XOHrhDApPqTp1u4TxBjQ" for 127.0.0.1 at 2014-05-15 22:11:49 +0200
Processing by Api::V1::ItemsController#create as JSON
Parameters: {"height"=>10.0, "item_name"=>"Super item", "width"=>20.0, etc...
However the same request fired at Heroku its treated as GET:
2014-05-15T20:27:58.137541+00:00 app[web.1]: Started GET "/api/v1/items?token=iEdDkDLiDUlWi0mDbr6XYw" for 89.74.57.51 at 2014-05-15 20:27:58 +0000
2014-05-15T20:27:58.223620+00:00 app[web.1]: Processing by Api::V1::ItemsController#index as JSON
Any idea? Of course both repos are in sync. Checked few times.
This is really weird... maybe some kind of Heroku cache magic?
HTTP/1.1 301 Moved Permanently
301 redirects are not Heroku magic. Your DNS (or possibly your app) is likely forwarding all apex requests (mydomain.com) to the www subdomain.
Using subdomains is preferred:
Heroku Dev Center: Custom Domains
I experienced a similar error when not using a custom domain just because of an easily overlooked error: I was using heroku.com instead of herokuapp.com
wrong:
http://my-app.heroku.com
right:
http://my-app.herokuapp.com
I suspect it's very similar in cause to the issue mentioned in Catsby's answer.
Well, I tried CURL, and it appeared error is silly.
I was posting at http://mydomain.com, where it's routed as GET.
When I fire at http://www.mydomain.com - it works.
Heroku magic.
Below are curl's and results for your reference. Maybe somebody will be able to explain why it works like this...
POST at mydomain.com
curl -v -H "Accept: application/json" -H "Cont"width":20.0,"item_desc":"The super item","std_pack":40,"sku":"A1004","depth":20.0}}' http://mydomain.com/api/v1/items?token=dSWeyKjjtZu0ZSs6b2J-yw
* Adding handle: conn: 0x7fe70b803000
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7fe70b803000) send_pipe: 1, recv_pipe: 0
* About to connect() to mydomain.com port 80 (#0)
* Trying 78.46.51.229...
* Connected to mydomain.com (78.46.51.229) port 80 (#0)
> POST /api/v1/items?token=dSWeyKjjtZu0ZSs6b2J-yw HTTP/1.1
> User-Agent: curl/7.30.0
> Host: mydomain.com
> Accept: application/json
> Content-type: application/json
> Content-Length: 174
>
* upload completely sent off: 174 out of 174 bytes
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 15 May 2014 21:20:58 GMT
* Server Apache is not blacklisted
< Server: Apache
< Location: http://www.mydomain.com/api/v1/items?token=dSWeyKjjtZu0ZSs6b2J-yw
< Content-Length: 273
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved here.</p>
</body></html>
* Connection #0 to host mydomain.com left intact
POST at www.mydomain.com
Maciejs-MacBook-Pro:merchbag maciejsimm$ curl -v -H "Accept: application/json" -H "Content-type: application/json" -X POST -d '{"item":{"height":10.0,"item_name":"Super duper item","width":20.0,"item_desc":"The super","std_pack":40,"sku":"A1005","depth":20.0}}' http://www.mydomain.com/api/v1/items?token=dSWeyKjjtZu0ZSs6b2J-yw
* Adding handle: conn: 0x7fc191003000
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7fc191003000) send_pipe: 1, recv_pipe: 0
* About to connect() to www.mydomain.com port 80 (#0)
* Trying 50.17.185.176...
* Connected to www.mydomain.com (50.17.185.176) port 80 (#0)
> POST /api/v1/items?token=dSWeyKjjtZu0ZSs6b2J-yw HTTP/1.1
> User-Agent: curl/7.30.0
> Host: www.mydomain.com
> Accept: application/json
> Content-type: application/json
> Content-Length: 133
>
* upload completely sent off: 133 out of 133 bytes
< HTTP/1.1 201 Created
< Cache-Control: max-age=0, private, must-revalidate
< Content-Type: application/json; charset=utf-8
< Date: Thu, 15 May 2014 21:24:17 GMT
< Etag: "41231ae0f50a604cd7316a014d19b3f2"
* Server WEBrick/1.3.1 (Ruby/2.0.0/2014-05-08) is not blacklisted
< Server: WEBrick/1.3.1 (Ruby/2.0.0/2014-05-08)
< Set-Cookie: request_method=POST; path=/
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Request-Id: ba05dd74-bf52-47d5-b8a9-d0516aff5804
< X-Runtime: 0.020289
< X-Ua-Compatible: chrome=1
< X-Xss-Protection: 1; mode=block
< Content-Length: 234
< Connection: keep-alive
<
* Connection #0 to host www.mydomain.com left intact
{"id":15,"partner_id":1,"sku":"A1005","item_name":"Super duper item","item_desc":"The super","std_pack":40,"height":10,"width":20,"depth":20,"image":null,"created_at":"2014-05-15T21:24:17.753Z","updated_at":"2014-05-15T21:24:17.761Z"}
I had this same issue when sending a POST request to heroku using HTTP instead of HTTPS. Every time heroku routed my POST requests as GET requests. Once I updated the url to use HTTPS, my POST requests were routed by heroku as POSTs and not GETs, resolving the issue. The redirection issues mentioned in the previous posts are likely the root cause of the issue I experienced as well.

Google cloud print get access token

I want to call /search method of Google cloud print from my webServer.
I am using OAuth web server guide obtaining a refresh_token/access_token to use with scopes:
https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile
Then I am calling search Api but I am obtaining a 403 forbidden.
Request DefaultHttpRequest(chunked: false)
POST /cloudprint/search HTTP/1.1
Host: www.google.com
Content-Type: text/plain; charset=utf-8
Authorization: OAuth yb29.1.AADtN_U9PYyVhGpcS-8MpFhfGVbT4KsZKEoIX2HGePwoNXypjrSwVsS0pGzmaqhktfGBAQ
Connection: keep-alive
Accept: */*
User-Agent: NING/1.0
Content-Length: 0
Response DefaultHttpResponse(chunked: true)
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Tue, 03 Dec 2013 17:05:09 GMT
Set-Cookie: NID=67=MQJFdl-YkMdz875n1J2yVNmeUeAvsjVtDGlNvGkNLZdNTHX3YbnStNx9Vg_MiRsmht6hj3XrwJcPJEQeFLlnYKqt2Of1xHJ5HDwNJgOB3svOdnN-JRFcPxYt4AU10eSM;Domain=.google.com;Path=/;Expires=Wed, 04-Jun-2014 17:05:09 GMT;HttpOnly
P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 443:quic
Transfer-Encoding: chunked
Is the scope correct?
What am I doing wrong?
Your scopes are wrong. The correct scope is https://www.googleapis.com/auth/cloudprint
I think this related to your HTTP Header 'Authorization'.
When playing at https://developers.google.com/oauthplayground/, I see the generated requests use 'Authorization: Bearer your-token', instead of 'Authorization: OAuth your-token'.

Resources