0

I am using express with node.js. As such, I have the following:

app.get('/callback', async function (req, res) {

When a user is sent to the callback portion of my site, I am supposed to receive these req & res parameters. However, I am having an issue here. The url my OAuth2 Application is sending the user to is the following:

https://example.com/callback#access_token=abc

Oh no! This creates a problem for me. I am unable to get the access_token from req! Please assist me on what I can do to retrieve the access token from this url. The parameters from req are only giving me /callback and others, but not the #access_token=abc

Fletcher Rippon
  • 1,837
  • 16
  • 21
Rishab Jain
  • 193
  • 1
  • 3
  • 11
  • 1
    The question is a bit unclear can you post the code for the `/callback` route? would be a lot of help :) – Fletcher Rippon Jun 06 '20 at 05:13
  • I've managed to fix the problem... I'm using FitBit OAuth2, and was using a different option called Implicit Grant Flow that instead went to a example.com/callback#access_code=abc instead of the correct option Authorization Code Flow. With this correct option, it now proceeds to a redirect link with question marks only, allowing req.query to be used, reading the url correctly. Not exactly sure why req isn't able to get parameters in the URL that have # in them. – Rishab Jain Jun 06 '20 at 05:43
  • 1
    the `#` in a URL is not what identifies a query the `?` is what will identify a URL query the `#` by itself does nothing but if you use it with an id name e.g. `#id-name` then it will send you to the section where that id element is but remember that URL queries are public so do not send sensitive information through a URL hope this helps – Fletcher Rippon Jun 06 '20 at 05:58

2 Answers2

0

Try replace # to %23, its not problem from NodeJS. Read https://www.w3schools.com/tags/ref_urlencode.ASP

max
  • 469
  • 3
  • 10
0

you can get parameters with this function as a work around

const url= 'https://example.com/callback#access_token=abc'

const url1= 'https://example.com/callback#access_token=abc&access_token1=abc1'


function getparams(url){
    const paramsobj={}

    if(url.includes('&')){
  const urlarray= url.split('#')
 const  parampairs =urlarray[1].split('&')
 parampairs.forEach(p => {
      const nwpair= p.split('=')
      paramsobj[nwpair[0]]=nwpair[1]
 });

}
if(!url.includes('&')){
    const urlarray= url.split('#')
      const keyvalue=urlarray[1].split('=')
    const arr=keyvalue
            let i=0
          while(i<arr.length+2) {
           key=keyvalue.shift()      
            value=keyvalue.shift()   
            paramsobj[key]=value
                  i++
          }    
}
return  paramsobj

}
params=getparams(url)
console.log(token=params.access_token1)
Sven.hig
  • 4,449
  • 2
  • 8
  • 18