0

I am using a PHP integration with UBER API. I am having trouble with the OAuth flow. I get {"error": "invalid_grant"} after trying to exchange an access code for an access token.

It was working well, but today it just stopped working. Debugging it, I see that Uber is providing access code in this format: IPjvWABDxk00000BxQQwJksP2I50qD#_ and I believe that the "#_" at the end is causing me problems, as php $_GET won't be able to read the full string (from IP.. to ...#_). My code:

$uber_access_code = $_GET["code"]; 

        $fields_string = '';
        $fields = array(
        'client_secret' => $uber_client_secret,
        'client_id' => $uber_client_id,
        'grant_type' => 'authorization_code',
        'code' => $uber_access_code,
        'redirect_uri' =>  $uber_redirect_uri,

        );

        foreach($fields as $key=>$value) { $fields_string .= $key.'='.$value.'&'; }
        rtrim($fields_string, '&');

        $ch = curl_init();   
        curl_setopt($ch,CURLOPT_URL, "https://login.uber.com/oauth/v2/token");
        curl_setopt($ch,CURLOPT_POST, count($fields));
        curl_setopt($ch,CURLOPT_POSTFIELDS, $fields_string);

        curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);

        $result = curl_exec($ch);

        curl_close($ch);

Question: How can I read the full string parameter from PHP? $_GET trims "#_" on my end, but I need the whole string.

Olecramoak
  • 126
  • 6

1 Answers1

0

When I tested it on my local machine I can replicate your problem, but I don't think it is a php problem. It looks like it is a browser issue. Since when I checked the apache access logs I can see it is sending request like. 

"GET /result.php?code=IPjvWABDxk00000BxQQwJksP2I50qD HTTP/1.1" 200 148

If you are the one who is creating this GET request URL you can do the following.

For e.g. form.php

<html>
    <body>
        <?php
            $link = base64_encode('IPjvWABDxk00000BxQQwJksP2I50qD#_');
        ?>
        <a href="result.php?code=<?php echo $link;?>">link</a>
    </body>
</html>

and the result.php 

<?php
var_dump(base64_decode($_GET['code']));
?>

and you get valid result like

string 'IPjvWABDxk00000BxQQwJksP2I50qD#_' (length=32)
Kamal Soni
  • 1,522
  • 13
  • 15
  • Thank you for your input @ksoni. However, the code is generated by UBER. They just do a 302 redirect with a "?code=" parameter on the URI. So, I can't control how they format it and need to read exacly how they send it (that's the issue). – Olecramoak Mar 03 '18 at 02:27
  • @Olecramoak It might not be obvious but # is used as anchor which is mostly for only for browser to be understood. So as long as you have that in your URL it will not work as expected. I believe it is just matter of asking them to change the code for you. Sorry I can't see any other work around for it. – Kamal Soni Mar 03 '18 at 02:40
  • You can ask them to base64 encode. As I said the access log shows it not received by php so you cannot fix at php end, unless you change the url through whatever mechanism available to you – Kamal Soni Mar 03 '18 at 02:41
  • @Olecramoak Please refer to this answer to get more understanding how fragments are removed by the useragent https://stackoverflow.com/a/9384464/3966730 – Kamal Soni Mar 03 '18 at 04:38