Ask HN: Does anyone else have problems with Instagram API OAuth2?

Post by sandes » Sat, Dec 17, 2016, 5:24 PM UTC

Post by xmrcivicboix » Sun, Dec 18, 2016, 12:30 AM UTC

AlexWhite_ wrote: post #30

xmrcivicboix wrote: post #26

To temporary fix the issue, you could do the following: change response_type=code to response_type=token. Instagram will redirect back to your site with something like /callback#access_token=123456. From here, send the user to a very simple page with the following snippet: if (window.location.hash && window.location.hash.indexOf('#access_token=') !== -1) { var accessToken = window.location.hash.replace('#access_token…

This solution is insecure. Any person can intercept token and make harm to your application.

Post by vikaton » Sun, Dec 18, 2016, 1:59 AM UTC

AlexWhite_ wrote: post #32

xmrcivicboix wrote: post #26

To temporary fix the issue, you could do the following: change response_type=code to response_type=token. Instagram will redirect back to your site with something like /callback#access_token=123456. From here, send the user to a very simple page with the following snippet: if (window.location.hash && window.location.hash.indexOf('#access_token=') !== -1) { var accessToken = window.location.hash.replace('#access_token…

but this is better than nothing, thank you!

Post by [deleted] » Sun, Dec 18, 2016, 3:26 AM UTC

xmrcivicboix wrote: post #36

vikaton wrote: post #34

Earlier quoted context omitted.

Where would I change response_type=code to response_type=token?

When you generate the server side explicit flow, it looks something like this: https://api.instagram.com/oauth/authorize/?client_id=CLIENT-... Depending on the library you use, it may be default to response_type=code. Just get the URL and do a search and replace if the library doesn't allow you to define the type. See https://www.instagram.com/developer/authentication/

Post by xmrcivicboix » Sun, Dec 18, 2016, 3:43 PM UTC

vikaton wrote: post #38

xmrcivicboix wrote: post #36

Earlier quoted context omitted.

When you generate the server side explicit flow, it looks something like this: https://api.instagram.com/oauth/authorize/?client_id=CLIENT-... Depending on the library you use, it may be default to response_type=code. Just get the URL and do a search and replace if the library doesn't allow you to define the type. See https://www.instagram.com/developer/authentication/

I use this library: https://github.com/jaredhanson/passport-oauth2 Something tells me however that just changing it to 'token' (file strategy.js, line 217) actually fixes it, now there are other issues with many redirects when just changing that line, Im not entirely sure how that library works to fix anything else at this point, do you know when this issue might be resolved as a whole?