Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone else have problems with Instagram API OAuth2?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Ask HN: Does anyone else have problems with Instagram API OAuth2?

#21

Post by krisrak »

I'm creator of https://picodash.com, I noticed the same issue about a week ago but did not get any complains from my customers, so debugged it for 8 hours until I found this (I know it will be hard to believe):

I kept getting "Matching code was not found or was already used." when using thru my oauth python code which btw has been working for 6 years now. But when I used curl to do POST, it worked, when I tried Curl again with same oauth code, it failed, So I think this is something that was recently changed by Instagram, the oauth code only works one time, I kind of remember this code could be used more than once before to make POST call, but there was time limit instead, after which using same code was failing.

So with me, this was always failing, but no complains from my customers, I could see logs that new people were signing up.

I started testing on localhost, I added debug logs, I did notice that there was 2 POST calls being made, so it was failing. I could see that 2 POST calls was made and first one did work and get access_token, but there was a second call made and this was error 400 and oauth flow was failing. Almost looked like a retry of POST call, cause my code should only make one.

I started trying different browsers, failed on all firefox,IE, safari, chrome. And then decided to try on my iphone, it worked 100%, so looked for difference, it was on LTE, so I guessed may be my wifi, switched to wifi on iphone and it started failing 100%. So now on my dev system, I connected modem directly to system without router and tried, it passed 100%, so it was my wireless router (I know weird), I tried another 3rd party instagram web app, had same issue but worked without the wireless router. So on Monday I got another wireless router and no issues, it started working. So this could be an isolated incident for me, I came to conclusion that I was using some old router that was dropping POST request and making second attempt and failing.

So I guess if this is affecting all your customer check you code by putting logs that you are making one POST request. Try making a CURL after you receive the code and make sure it is working on first attempt.

Today after reading this, I check my oauth login again, I did notice it fail few times, but when I try again, it is passing, so something changed again I think.

Re: Ask HN: Does anyone else have problems with Instagram API OAuth2?

#22

Post by svens_ »

krisrak wrote: post #21

I'm creator of https://picodash.com , I noticed the same issue about a week ago but did not get any complains from my customers, so debugged it for 8 hours until I found this (I know it will be hard to believe): I kept getting "Matching code was not found or was already used." when using thru my oauth python code which btw has been working for 6 years now. But when I used curl to do POST, it worked, when I tried Curl…

Sorry, but this is definitely not a hardware, connection or session issue. Just check the rest of the thread. We're seeing issues over various links (broadband, mobile, datacenter) on different server locations (AWS vs. on dev machine) with or without private mode / logging out and then in.

I honestly wish it was something like this, at least then we could fix it.

The double POST requests you see is most probably because api.instagram.com returns a 302 response ("Found", i.e. redirect). This is a relatively recent change, but still weeks before those issues started.

By the way, your server refuses connection when you go to https://picodash.com directly (without www.). You might want to fix this.

Re: Ask HN: Does anyone else have problems with Instagram API OAuth2?

#26

Post by xmrcivicboix »

To temporary fix the issue, you could do the following:

change response_type=code to response_type=token. Instagram will redirect back to your site with something like /callback#access_token=123456. From here, send the user to a very simple page with the following snippet:

    if (window.location.hash && window.location.hash.indexOf('#access_token=') !== -1) {
        var accessToken = window.location.hash.replace('#access_token=', '');
        window.location = '/callback?access_token=' + accessToken;
    }

After that, you just use the Instagram API to retrieve user by access token then perform log in. This is not a recommended flow by Instagram but is a flow that works for now if your customers are constantly hammering you with support tickets as they did with us.

Re: Ask HN: Does anyone else have problems with Instagram API OAuth2?

#28

Post by sodbileg »

Some of our customers have complained how they were having issues with logging in with their account a few days ago. We've tested it on our end and it was working without any issue. However, we encountered the issue yesterday and still having it. However, a very few customers are not having any issue. Really weird and annoying. Reported to Instagram, still no feedback.

Re: Ask HN: Does anyone else have problems with Instagram API OAuth2?

#29

Post by AlexWhite_ »

What we know at this moment:

1. It not depends on IP of API server behind instagram load balancer 2. It appears on ipv4 and ipv6 both 3. Problem not depends on delay between request code and exchanging this code for token 4. Logout and login helps sometimes

Re: Ask HN: Does anyone else have problems with Instagram API OAuth2?

#30

Post by AlexWhite_ »

xmrcivicboix wrote: post #26

To temporary fix the issue, you could do the following: change response_type=code to response_type=token. Instagram will redirect back to your site with something like /callback#access_token=123456. From here, send the user to a very simple page with the following snippet: if (window.location.hash && window.location.hash.indexOf('#access_token=') !== -1) { var accessToken = window.location.hash.replace('#access_token…

This solution is insecure. Any person can intercept token and make harm to your application.
Post reply on HN