2

I am trying to do some customization on a basic code to authenticate to dropbox. I want my application to authenticate the user to dropbox directly, no third authentication involved. So basically the only authentication I want to have is against Dropbox. Currently I am having two problems:

  1. The code I came with goes into a infinit redirect loop.
  2. I am receiving the following php error I think related to $_SESSION:

    [Mon May 25 12:45:40.651325 2015] [:error] [pid 6568] [client 127.0.0.1:48900] PHP Fatal error:  Uncaught exception 'Dropbox\\WebAuthException_Csrf' with message 'Expected '0_2rtH-FFcAqzX4JLKPVKw==', got 'zdmJEkNgto3lA7qAgGW2SQ=='.' in /var/www/php/oauth/vendor/dropbox/dropbox-sdk/lib/Dropbox/WebAuth.php:242\nStack trace:\n#0 /var/www/php/oauth/web/dropbox_finish.php(11): Dropbox\\WebAuth->finish(Array)\n#1 {main}\n  thrown in /var/www/php/oauth/vendor/dropbox/dropbox-sdk/lib/Dropbox/WebAuth.php on line 242
    

This is my code start.php:

session_start();
require_once __DIR__.'/../vendor/autoload.php';
$key = "fttwagu78r37ped";
$secret = "9s10lkjhrwpujbl";
$GLOBALS['app_name'] = "oauth-php/1.0";
$GLOBALS['redirectURI'] = "https://oauth.dev/dropbox_finish.php";
$GLOBALS['HomeURI'] = "https://oauth.dev";

$appInfo = new Dropbox\AppInfo($key, $secret);
$csrfTokenStore = new Dropbox\ArrayEntryStore($_SESSION, 'dropbox-auth-csrf-token');
$webAuth = new Dropbox\WebAuth($appInfo, $GLOBALS['app_name'], $GLOBALS['redirectURI'], $csrfTokenStore);

$authURL = $webAuth->start();
header("Location: $authURL");

and this dropbox_finish.php:

require_once "../app/start.php";
try {
   list($accessToken, $userId, $urlState) = $webAuth->finish($_GET);
   assert($urlState === null);  // Since we didn't pass anything in start()
}
catch (dbx\WebAuthException_BadRequest $ex) {
   error_log("/dropbox-auth-finish: bad request: " . $ex->getMessage());
   // Respond with an HTTP 400 and display error page...
}

Can anyone help me with this one?

wti
  • 494
  • 4
  • 19

1 Answers1

1

It looks like you're including start.php in dropbox_finish.php, but start.php calls $webAuth->start() and then redirects the user.

Make sure that the part you're including in dropbox_finish.php doesn't have that call and doesn't set the Location header.

user94559
  • 59,196
  • 6
  • 103
  • 103