3

I got a Jersey Grizzly REST server running. Now i am receiving receiveing an URL from Microsoft with an Access Token however this access token is placed as an parameter after a # Symbol.

https://myURL.com/getToken/pathParam/#access_token=QWERwtrrgertWRDGTGHssef....

When i receive the Request from MS i cant read out the access token by any means, since it is filtered out. Is there a configuration where I can stop this and get the token as a param ?

Paul Samsotha
  • 205,037
  • 37
  • 486
  • 720
Maevy
  • 261
  • 4
  • 24
  • I think the number sign must be url-encoded. Otherwise it will not be transferred to the server as part of the url. http://stackoverflow.com/questions/8033537/getting-hash-parameters-from-request-url – Christoph Giesche Jul 22 '15 at 14:49

1 Answers1

2

From the looks of the fragment, it appears you are trying to accomplish an OAuth flow. The problem I see is that you are trying to implement a flow that is meant for the client side (or more correctly, user-agent side), and then trying to access the fragment on the server, which is meant to be interpreted on the user-agent side.

The #access_token.. tells me you are trying to implement the Implicit Grant. This is not recommended if you have access to the more common Authorization Code Grant. I don't know what Microsoft service you are using, but if they offer the Implicit Grant, then they should also offer the Authorization Code Grant, which is actually the most common in all of the Grant types.

If you want to stick with the Implicit Grant, then you will need to actually handle the redirect from the client (user-agent) side, meaning get your hands into writing some Javascript to postback the token to the server. You can see an example here.

I personally wouldn't recommend it. You can have a look at the Jersey OAuth 2.0 client. It will help with implementing the Authorization Code flow.

Community
  • 1
  • 1
Paul Samsotha
  • 205,037
  • 37
  • 486
  • 720