Paw not finding access_token from OAuth proxy

Question

I have a use-case where I need to spoof a white-listed Redirect URL locally when performing OAuth 2 authentication.

I'm running a very basic web-server coupled with a hosts file entry for the domain I'm spoofing. I'm able to correctly negotiate my tokens and return them to Paw, but Paw isn't picking up my access_token or refresh_token, it simply displays the raw response:

Here's my server code (with placeholders for sensitive data):

var http = require('http'),
    request = require('request');

var PORT = 6109;

var server = http.createServer(function(req, res) {
    var code = req.url.split('?')[1].split('=')[2];

    request({
        url: 'https://<access token URL>/oauth2/token?code=' + code,
        method: 'POST',
        form: {
            'client_id': <client_id>,
            'client_secret': <client_secret>,
            'grant_type': 'authorization_code',
            'redirect_uri': <spoofed redirect URL>
        }
    }, function(err, response, data) {
        data = JSON.parse(data);

        res.writeHead(200, {'Content-Type': 'application/json'});
        res.write(JSON.stringify(data.result));

        // I also tried this with the same end-result
        // res.writeHead(200);
        // res.write('access_token=' + data.result.access_token + '&token_type=' + data.result.token_type + '&refresh_token=' + data.result.refresh_token);
        res.end();
    });
});

server.listen(PORT, function() {
    console.log('Server listening on port %d', PORT);
});

What am I missing? Why isn't Paw finding my tokens?

Here's my configuration for reference:

Some other noteworthy points:

• The OAuth provider is non-standard and flubs quite a few things from the spec (my proxy exists in part to patch up the non-standard bits)
• The domain for the Redirect URL is real, but the URL does not resolve (this is a part of the reason for the local hosts entry)
• I'm not showing this part of the flow, but I am correctly completing the authorization step prior to being given the code value

Answer 1

I think you're probably confused between the Authorization URL and Access Token URL. When you're in Authorization Code grant type for OAuth 2, you're expected to have a user confirmation step in a web page (the Authorization URL).

Which makes me guess that instead, you're expecting instead to use the Password Grant or Client Credentials? Otherwise, if you want to use Authorization URL, you'll need to specify a webpage at the Authorization URL.

---

Note: I've tried your Node.js script in Paw using the two last grants I mentioned (Password Grant & Client Credentials), and it works nicely.

---

Update: Following the comments below, I understand more what you are doing. The Authorization Request should (if successful) return a 302 redirect response to the Redirect URL page, and append a code URL query param to it. It seems like you're returning a JSON response with the code instead, so Paw isn't catching it.

According to the OAuth 2.0 spec (RFC 6749), section *4.1.2. Authorization Response*, if granted, the code should be passed as a URL query param (i.e. a ?key=value param in the URL) to the Redirect URL when doing the redirection.

If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the "application/x-www-form-urlencoded" format

Quoting the example from the spec, here's how the response of the Authorization Request should look like if it's a success (code is granted):

HTTP/1.1 302 Found
Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA
           &state=xyz

Answer 2

I saw that the Redirect URL contains "my Spoofed Uri".

When we need to use authorization code flow, we provide the authorization code and redirect Uri.

When the URI you are providing does not match the URI saved for the client in Identity server, you will not be able to get the token as the URI does not match with the client authorization code.

For example : Consider client identity in the Identity server be: Auth Code: "xyx" Redirect Uri: "www.mylocalhost.com\xyz"

And in your example the combination you are providing is: Auth Code: "xyx" Redirect Uri: "<my spoofed uri>"

As these 2 wont match there will be no token received.

I believe if you use the correct URI that is registered with the client in the Identity server, you will be able to receive the token.