New
Nov 22, 2020 12:21 PM
#91
See this topic to obtain a token with a bash script. |
Nov 26, 2020 1:56 AM
#92
用postman 发送POST请求获取token ,报以下的错,https://myanimelist.net/v1/oauth2/token { "error": "invalid_request", "message": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.", "hint": "Authorization code has expired" } |
Nov 26, 2020 4:11 AM
#93
After you've obtained an Authorisation Code, you must use it almost immediately. Authorisation Codes will expire after a few minutes, so you've probably run your Postman query too late. |
Nov 30, 2020 9:12 AM
#94
ZeroCrystal said: Just remember that the website must be served via HTTPS, or you won't be able to receive the authorisation code. Good luck with the project! So, I finally got around to do some more in-depth coding in that regard but, unfortunately, I seem to be stuck on something I can't debug. I am pretty much taking the vanilla PKCE Challenge example on GitHub below to create everything I need and then request the authorization endpoint to get the authorization code that then my users can use to add to their plugins. So far so good. I start the request and get the Basic HTTP login box in which I enter my username and password and click OK and the only thing that happens is that I get another login box. I can keep "logging in" as much as I want without any change. Keep getting the Login box. I even created a new App for a new Client_ID thinking that maybe something internally went wrong with my old one, but without any change in its behaviour. Funnily enough, I can't even delete my old Clients because then I get a "400 Bad Request" Maybe you have some Idea where I can look? https://github.com/aaronpk/pkce-vanilla-js |
Nov 30, 2020 9:39 AM
#95
Fribbtastic said: I am pretty much taking the vanilla PKCE Challenge example on GitHub below to create everything I need and then request the authorization endpoint to get the authorization code that then my users can use to add to their plugins. https://github.com/aaronpk/pkce-vanilla-js The GitHub example you've linked uses a different OAuth schema where the Code Challenge is a hashed version (SHA-256) of the Code Verifier. Instead, MAL requires that both the Code Challenge and the Code Verifier must be the exact same string. Similarly, there're some other parameters that need to be altered (e.g. "code_challenge_method"). Fribbtastic said: Maybe you have some Idea where I can look? Before I suggest you something different, can you try testing your application using a fixed and pre-generated Code Verifier/Code Challenge? For instance, you can use the string given by repeating 'A' × 128 times, which you can copy-paste it from here. |
Nov 30, 2020 9:51 AM
#96
ZeroCrystal said: The GitHub example you've linked uses a different OAuth schema where the Code Challenge is a hashed version (SHA-256) of the Code Verifier. Instead, MAL requires that both the Code Challenge and the Code Verifier must be the exact same string. Similarly, there're some other parameters that need to be altered (e.g. "code_challenge_method"). I read about the code_challenge_method to being only plain so that is also set to plain instead of S265 but this doesn't seem to be the issue. ZeroCrystal said: Before I suggest you something different, can you try testing your application using a fixed and pre-generated Code Verifier/Code Challenge? For instance, you can use the string given by repeating 'A' × 128 times, which you can copy-paste it from here. I copied the 128xA and replaced the generated code verifier and code challenge with it. The authentication URL is called with it but still end up in a login loop. I will send you a message with the actual running code so that we are on the same page. |
Dec 1, 2020 7:46 AM
#97
Fribbtastic said: I will send you a message with the actual running code so that we are on the same page. We solved this issue via PMs, but I thought that sharing the cause of the problem might help someone else. @Fribbtastic's problem was that the Redirect URL he registered in the API panel matched the one he specified in the Authorisation URL except for the letter case. Technically speaking, domain names are not case sensitive. For instance, both myanimelist.net and MYanimeLIST.nEt correspond to the same domain and DNS entries. However, this equivalence is ignored by the API back-end. For this reason, using a Redirect URL with a different casing than the one defined in the API panel will result in an error (or, rather, in a weird response from MAL servers). Please, double-check your Redirect URLs if you've encountered a similar problem. Pending slashes will also result in the same error (e.g. myanimelist.net ≠ myanimelist.net/). |
Dec 1, 2020 8:58 AM
#98
Hi, I'm having a hard time getting a request to get an anime list from the API server in python. Is there any chance I could see an example of it? Also, is there a way to extract the JSON, XML, HTTP, info as well. I'm using the API for a school project, and I was having a hard time with those two things. |
Dec 1, 2020 9:05 AM
#99
quake_01 said: Hi, I'm having a hard time getting a request to get an anime list from the API server in python. Is there any chance I could see an example of it? Sure thing! I wrote a minimal Python programme covering both the OAuth authorisation procedure (which is a one-time step) and the use of the API (using the "Get my user information" endpoint). You can find it here: gitlab.com/-/snippets/2039434. |
Dec 1, 2020 9:41 AM
#100
Oh okay!! So, I have the access token now, and I think this is where I was stuck before. So, to use a get request to get an anime list would be similar to when you tested the API to request your profile information? |
Dec 1, 2020 10:46 AM
#101
quake_01 said: So, to use a get request to get an anime list would be similar to when you tested the API to request your profile information? Yes, the code is very similar. Take a look at the official documentation to find all the info you might need: Get user anime list. For example, here's a function which prints some data about the first 10 entries of the user's anime list: # See: https://myanimelist.net/apiconfig/references/api/v2#operation/users_user_id_animelist_get def print_first_10_anime_list_entries(access_token: str): url = 'https://api.myanimelist.net/v2/users/@me/animelist' response = requests.get(url, headers = { 'Authorization': f'Bearer {access_token}' }, params = { 'limit': 1000, # How many anime you want in each response 'fields': 'id,title,mean,popularity' # List of anime's information you need # The 'fields' parameter behaves as in https://myanimelist.net/apiconfig/references/api/v2#operation/anime_anime_id_get }) response.raise_for_status() anime_list = response.json() response.close() anime_data = anime_list['data'] # Print the ID, title, mean score and member counter of your first 10 anime for i in range(min(10, len(anime_data))): anime = anime_data[i]['node'] print(f"[{anime['id']}] {anime['title']}") print(f"Mean score: {anime.get('mean', '???')} | Members: {anime.get('popularity', '???')}\n") |
Dec 1, 2020 12:01 PM
#102
I am getting the unsupported grant type error and it seems that I am not generating a token at all. I was able to get it in my http simulator, but I keep getting invalid in my code. Here is my code to generate the token, any idea what the issue is (its JS code): function access_token_request(code, anime, response){ const url = "https://myanimelist.net/v1/oauth2/token"; const data = querystring.stringify({grant_type:"authorization_code", client_id, client_secret, code, code_verifier}); let option = { method: "POST", header:{ "Content-Type":"application/x-www-form-urlencoded" }, } https.request( url, option, (stream) => process_stream(stream, receiveAccessToken, anime, response) ).end(data); } I also tried adding the data to the body but it didn't work either. |
bakugo411Dec 1, 2020 7:32 PM
Dec 2, 2020 4:18 AM
#103
bakugo411 said: I am getting the unsupported grant type error and it seems that I am not generating a token at all. I was able to get it in my http simulator, but I keep getting invalid in my code. You misspelt "header" inside the "option" object, the right version is "headers". Also, I don't know the content of the "process_stream" function, so there might be a bug in there as well. Either way, I slightly altered your code to make it work. Here's the snippet: const https = require('https'); const querystring = require('querystring'); const url = "https://myanimelist.net/v1/oauth2/token"; const data = querystring.stringify({ grant_type: "authorization_code", client_id: "YOUR CLIENT ID", client_secret: "YOUR CLIENT SECRET", code: "YOUR AUTHORISATION CODE", code_verifier: "YOUR CODE VERIFIER" }); let options = { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, }; const request = https.request( url, options, (response) => { console.log('Status code: ', response.statusCode); response.on('data', (buffer) => { console.log(buffer.toString()); }); } ); request.on('error', (error) => { console.error(error); }); request.end(data); |
Dec 2, 2020 9:07 AM
#104
Hello! Thank you very much for this wonderful guide. I am trying to implement the login functionality in my android app and everything went smoothly till the token exchange step. I get a weird error which says: AuthorizationException: {"type":2,"code":2002,"error":"invalid_grant","errorUri":""} I have checked that my code challenge in auth and token phases are the same, tried with both AppAuth and Retrofit, nothing helps. I am at the end of my wit here. |
HelpfulSchwarzDec 2, 2020 9:11 AM
Dec 2, 2020 10:06 AM
#105
HelpfulSchwarz said: Hello! Thank you very much for this wonderful guide. I am trying to implement the login functionality in my android app and everything went smoothly till the token exchange step. I get a weird error which says: AuthorizationException: {"type":2,"code":2002,"error":"invalid_grant","errorUri":""} I have checked that my code challenge in auth and token phases are the same, tried with both AppAuth and Retrofit, nothing helps. I am at the end of my wit here. I skimmed through the repository but it's hard to pinpoint the issue as the codebase is quite large and you're using a third-party OAuth client (OpenID's AppAuth) which is poorly documented. So far I've found one critical error: in this file at line 23 you called the setCodeVerifier(codeChallenge) method to set the Code Verifier. However, this function uses the S256 challenge method (i.e. Code Challenge = SHA-256(Code Verifier)), while MAL only supports the "plain" method (docs). You should be able to fix this by using the second overload of the same method: setCodeVerifier(String codeVerifier, String codeVerifierChallenge, String codeVerifierChallengeMethod). The three parameters you have to pass should be codeChallenge, codeChallenge, and AuthorizationRequest.CODE_CHALLENGE_METHOD_PLAIN. Try fixing this and retry. There might be other bugs in the code, maybe it would be easier to build the OAuth client from scratch. |
ZeroCrystalDec 2, 2020 10:14 AM
Dec 2, 2020 10:23 AM
#106
[quote=ZeroCrystal message=61282967] bakugo411 said: I am getting the unsupported grant type error and it seems that I am not generating a token at all. I was able to get it in my http simulator, but I keep getting invalid in my code. You misspelt "header" inside the "option" object, the right version is "headers". Also, I don't know the content of the "process_stream" function, so there might be a bug in there as well. Thank you so much for catching my error! |
Dec 3, 2020 1:59 AM
#107
ZeroCrystal said: HelpfulSchwarz said: Hello! Thank you very much for this wonderful guide. I am trying to implement the login functionality in my android app and everything went smoothly till the token exchange step. I get a weird error which says: AuthorizationException: {"type":2,"code":2002,"error":"invalid_grant","errorUri":""} I have checked that my code challenge in auth and token phases are the same, tried with both AppAuth and Retrofit, nothing helps. I am at the end of my wit here. I skimmed through the repository but it's hard to pinpoint the issue as the codebase is quite large and you're using a third-party OAuth client (OpenID's AppAuth) which is poorly documented. So far I've found one critical error: in this file at line 23 you called the setCodeVerifier(codeChallenge) method to set the Code Verifier. However, this function uses the S256 challenge method (i.e. Code Challenge = SHA-256(Code Verifier)), while MAL only supports the "plain" method (docs). You should be able to fix this by using the second overload of the same method: setCodeVerifier(String codeVerifier, String codeVerifierChallenge, String codeVerifierChallengeMethod). The three parameters you have to pass should be codeChallenge, codeChallenge, and AuthorizationRequest.CODE_CHALLENGE_METHOD_PLAIN. Try fixing this and retry. There might be other bugs in the code, maybe it would be easier to build the OAuth client from scratch. Thank you very much for taking time to look through my code! I have tried it and it finally worked :) |
Dec 3, 2020 2:21 AM
#108
HelpfulSchwarz said: Thank you very much for taking time to look through my code! I have tried it and it finally worked :) That's great to hear! Good luck with your app. |
Jan 11, 2021 5:57 AM
#109
https://mal.auth0.com/.well-known/openid-configuration is it myanimelist's or not? I want to access api with flutter like in this link https://auth0.com/blog/get-started-with-flutter-authentication/#Integrate-Auth0-with-Flutter but i dont understand openid part |
Jan 11, 2021 6:17 AM
#110
ahmetbugraozcan said: https://mal.auth0.com/.well-known/openid-configuration is it myanimelist's or not? It's not MyAnimeList, just a different company with the same acronym. I'm not sure about which OAuth libraries are available for Flutter, but it's probably easier to implement the authorisation workflow by hand. It's simpler than it might sound. |
Jan 14, 2021 3:15 AM
#111
-------------------------------------- SOLVED -------------------------------------- I did it as you said. But i stucked in step 4 now. I am sure my authcode and challenge is correct. But its giving me that error : {"error":"unsupported_grant_type","message":"The authorization grant type is not supported by the authorization server.","hint":"Check the `grant_type` parameter"} After pressing allow it returning this : myapp/auth?code=def50......94&state=RequestID42 So i parse auth code like this : def50.....94 I am assuming this is true. I read 3 page of this topic but this solutions doesnt work for me. this is my code is there any problem? Future<http.Response> getToken(String authCode, String challenge) async { var result = await http.post( 'https://myanimelist.net/v1/oauth2/token', headers: <String, String>{ 'Content-Type': 'application/x-www-form-urlencoded', }, body: jsonEncode(<String, String>{ 'client_id': 'myClientID', 'code': '$authCode', 'code_verifier': '$challenge', 'grant_type': 'authorization_code', }), ); return result; } I apologize for asking so many questions. ----------------------------- SOLVED ---------------------------- I removed jsonencode part Future<http.Response> getToken(String authCode, String challenge) async { var result = await http.Client().post( 'https://myanimelist.net/v1/oauth2/token', headers: <String, String>{ 'Content-Type': 'application/x-www-form-urlencoded', }, body: { 'client_id': 'myClientID', 'code': '$authCode', 'code_verifier': '$challenge', 'grant_type': 'authorization_code', }, ); return result; } This is the last code now. |
shadoukira123Jan 14, 2021 3:47 AM
Jan 28, 2021 2:33 PM
#112
Blocked By Cross-Origin Policy Hello, I'm trying to get the user's access token. I'm actually using vueJS (a JavaScript framework) to make my application but I can't make post request to another domain it's blocked by CORS Policy so I always have this error on consol: localhost/:1 Access to XMLHttpRequest at 'https://myanimelist.net/v1/oauth2/token' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. This is my post request make by axios: axios({ method: 'POST', url: 'https://myanimelist.net/v1/oauth2/token', data: { 'code': this.$route.query.code, 'code_verifier': this.$session.get('codeVerifier'), 'client_id': process.env.VUE_APP_CLIENTID, 'grant_type': 'authorization_code' } }) Do you have any solution to get the user's access token in VueJS? |
Jan 28, 2021 3:31 PM
#113
Terlaws33 said: Blocked By Cross-Origin Policy Hello, I'm trying to get the user's access token. I'm actually using vueJS (a JavaScript framework) to make my application but I can't make post request to another domain it's blocked by CORS Policy so I always have this error on consol: … Do you have any solution to get the user's access token in VueJS? Unfortunately, the API is poorly suited for front-end scenarios like browser-powered applications or userscripts. I explained the problem (and a possible solution) in #36: ZeroCrystal said: As we've briefly discussed in the previous posts, at the moment it's not possible to interact with the API straight from the browser. Normally, you would write something like: function onComplete() { console.log(this.responseText); } const request = new XMLHttpRequest(); request.addEventListener("load", onComplete); request.open("GET", "https://api.myanimelist.net/v2/users/@me"); request.setRequestHeader("Authorization", "Bearer YOUR_ACCESS_TOKEN"); request.send(); // Use "request.send(JSON.stringify({ ... }))" when you need // to include parameters inside the body of the HTTP request. Unfortunately, the API servers don't include the CORS headers required to execute the above code snippet. If you don't know what CORS is, you can read this short MDN article. This is an issue that should be solved by MAL's dev team. In the meantime, the easiest solution is probably to use a public reverse proxy to access the API. CORS Anywhere is an example. You can replace the original URL with: function onComplete() { console.log(this.responseText); } const request = new XMLHttpRequest(); request.addEventListener("load", onComplete); request.open("GET", "https://cors-anywhere.herokuapp.com/api.myanimelist.net:443/v2/users/@me"); request.setRequestHeader("Authorization", "Bearer YOUR_ACCESS_TOKEN"); request.send(); This snippet should work as expected, but you are relying on a third-party service. It should be ok for testing, but you shouldn't be using it for public applications. Hosting your own reverse proxy is a better solution (the code for CORS Anywhere is open-source). Still, a proper solution has to be deployed by MAL. |
Feb 19, 2021 4:52 PM
#115
Hi, I was following your guide but I can't figure out how to get the users acces token. I have made a POST request with the requestBody containing all the required info but I still get the error: {"error":"unsupported_grant_type","message":"The authorization grant type is not supported by the authorization server.","hint":"Check the `grant_type` parameter"} Heres my code (Java): https://pastebin.com/1fWLxdzq EDIT: Problem solved! My code was missing two "=" in the requestBody. And of course after working on this for 2 days I figure it out 10 minutes after postin this. |
Lege111Feb 19, 2021 5:37 PM
Feb 20, 2021 1:31 AM
#116
Lege111 said: And of course after working on this for 2 days I figure it out 10 minutes after postin this. A classic. |
Feb 21, 2021 11:24 AM
#117
selective53 said: I'm having trouble receiving the access token in JS. I'm sending the following POST request with XMLHttpRequest encoded with encodeURI(): `https://myanimelist.net/v1/oauth2/token?client_id=${oAuth.client_id}&client_secret=${oAuth.client_secret}&grant_type=${oAuth.grant_type}&code=${oAuth.code}&code_verifier=${oAuth.code_challenge}` That's because you shouldn't pass those parameters as part of the query string. They must be form-URL encoded and placed inside the body of the POST request. Either way, if you're building a browser-side application, you will have some issues with the (missing) CORS headers. I explained the problem (and a possible solution) in #36: ZeroCrystal said: As we've briefly discussed in the previous posts, at the moment it's not possible to interact with the API straight from the browser. Normally, you would write something like: function onComplete() { console.log(this.responseText); } const request = new XMLHttpRequest(); request.addEventListener("load", onComplete); request.open("GET", "https://api.myanimelist.net/v2/users/@me"); request.setRequestHeader("Authorization", "Bearer YOUR_ACCESS_TOKEN"); request.send(); // Use "request.send(JSON.stringify({ ... }))" when you need // to include parameters inside the body of the HTTP request. Unfortunately, the API servers don't include the CORS headers required to execute the above code snippet. If you don't know what CORS is, you can read this short MDN article. This is an issue that should be solved by MAL's dev team. In the meantime, the easiest solution is probably to use a public reverse proxy to access the API. CORS Anywhere is an example. You can replace the original URL with: function onComplete() { console.log(this.responseText); } const request = new XMLHttpRequest(); request.addEventListener("load", onComplete); request.open("GET", "https://cors-anywhere.herokuapp.com/api.myanimelist.net:443/v2/users/@me"); request.setRequestHeader("Authorization", "Bearer YOUR_ACCESS_TOKEN"); request.send(); This snippet should work as expected, but you are relying on a third-party service. It should be ok for testing, but you shouldn't be using it for public applications. Hosting your own reverse proxy is a better solution (the code for CORS Anywhere is open-source). Still, a proper solution has to be deployed by MAL. EDIT: @selective53, you deleted your post just a few seconds before I wrote this message. Do you still need some help? |
Feb 21, 2021 11:40 AM
#118
Thanks, I figured it out right before deleting it. For anyone else coming across this problem in JS using XMLHttpRequest, I got it working like this: xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded') xhttp.send(FormData= `client_id=${oAuth.client_id}&client_secret=${oAuth.client_secret}&grant_type=${oAuth.grant_type}&code=${oAuth.code}&code_verifier=${oAuth.code_challenge}`) I use Tampermonkey and modify the site so hopefully I won't run into CORS issues. |
Feb 21, 2021 11:51 AM
#119
selective53 said: I use Tampermonkey and modify the site so hopefully I won't run into CORS issues. In that case, you might need to use the GM_xmlhttpRequest(…) function to bypass any eventual cross-site origin error. |
May 31, 2021 6:28 AM
#120
Hello. I don't get it, should I use oAuth 2 to get token even if I want to access public data like top of anime or manga? If so, how official android mal client works if I cancel authorization? If not, where to get Bearer YOUR_TOKEN without user ID? It seems like on step 4 I need Parameter code: the user's Authorization Code received during the previous step. (REQUIRED) (Step 3 - User redirection), Thanks a lot. |
May 31, 2021 8:10 AM
#121
R1dje said: Hello. I don't get it, should I use oAuth 2 to get token even if I want to access public data like top of anime or manga? Yes. Currently, there're no “anonymous” API endpoints that you can use without being authenticated (via OAuth). They will be added in the future. R1dje said: If so, how official android mal client works if I cancel authorization? If not, where to get Bearer YOUR_TOKEN without user ID? It seems like on step 4 I need Parameter code: the user's Authorization Code received during the previous step. (REQUIRED) (Step 3 - User redirection) MAL's official mobile app doesn't use the public API (or, at least, not completely). They run their own private endpoints to compensate for some of the issues and missing features of the public API. I don't know if they mix private and public API calls, but some of the things the app is capable of are impossible to reproduce on a third-party application without performing some minor “hacking”. |
Jul 23, 2021 1:48 AM
#122
I'm trying to build a Discord bot that interfaces with MALs API, is it possible to search for anime by string rather than an integer value? I don't think it's reasonable to expect the average user to know the integer id of the anime they want information on. |
Jul 27, 2021 4:54 AM
#123
Wheelz said: I'm trying to build a Discord bot that interfaces with MALs API, is it possible to search for anime by string rather than an integer value? I don't think it's reasonable to expect the average user to know the integer id of the anime they want information on. The https://api.myanimelist.net/v2/anime method ("get anime list") includes an optional "q" search string and can thus be used for exactly this purpose. Documentation : https://myanimelist.net/apiconfig/references/api/v2#operation/anime_get |
Oct 13, 2021 4:20 AM
#124
anyone tried authenticating with next-auth.js? had any luck? for me it seems that it can't retrieve the correct url (after "Allow" screen), and it crashes on the callback |
Set by Secret Santa Stardew <3 |
Oct 14, 2021 8:57 AM
#125
Chop_in said: anyone tried authenticating with next-auth.js? had any luck? for me it seems that it can't retrieve the correct url (after "Allow" screen), and it crashes on the callback I've never used that library, but, according to the docs (here), you cannot set the "code_challenge_method" to "plain" and thus it's incompatible with MAL. |
Oct 14, 2021 9:08 AM
#126
ZeroCrystal said: I've never used that library, but, according to the docs (here), you cannot set the "code_challenge_method" to "plain" and thus it's incompatible with MAL. Thanks, the error code wad different and I didn't even think about it. Anyway i spent probably around 8 hours total trying to debug this thing, and then wrote simple authirization myself in an hour. I hate js libraries even more now :) |
Set by Secret Santa Stardew <3 |
Oct 14, 2021 9:15 AM
#127
Chop_in said: I hate js libraries even more now :) Welcome to the club! ^^ The authorisation flow is not complicated, it's probably easier to write some code from zero than spending hours looking for the right library. |
Oct 16, 2021 4:54 PM
#128
I get my code perfectly fine, but I'm having issues with getting the token. When I run the query in postman I get the following: { "error": "invalid_request", "message": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.", "hint": "Cannot decrypt the authorization code" } When I run it in laravel I get this: error: "unsupported_grant_type" hint: "Check the `grant_type` parameter" message: "The authorization grant type is not supported by the authorization server." |
Oct 16, 2021 4:59 PM
#129
Hey @allanrivers, are you certain that you're passing the parameters form-url encoded instead of appearing them to the query string? Can you post your Postman configuration or your Laravel code? |
Oct 16, 2021 5:00 PM
#130
I actually just used your python script instead. Worked like an absolute charm, thank you! |
Oct 16, 2021 5:02 PM
#131
allanrivers said: I actually just used your python script instead. Worked like an absolute charm, thank you! Good. Glad it helped! |
Oct 22, 2021 11:05 AM
#132
First of all: Thanks for all your hard work here ZeroCrystal! I am having problems with the API authorization for my Android application. My URL looks like this: https://myanimelist.net/v1/oauth2/authorize?response_type=code&client_id=9c3f...&code_challenge=zl3BDXBb3Mnd6HY-9081v1e-_HrwaVdU5k.UIGUU1~lUx~kk3xZ97~w9Lv9eQYE0gY1T77WObngJ0G-VBobJ6L94RCVS6W6H__Oq5.wWLU-vaP7PGzDq2ywIS0Up5HVt In the API panel, I tried various redirect urls - at the moment I just use: http://localhost/oauth After entering my credentials, I am getting redirected to a page saying "400 Bad Request" (https://myanimelist.net/login.php?from=%2Fdialog%2Fauthorization) Any idea as to why that happens? Thanks in advance! |
Oct 22, 2021 2:43 PM
#133
Nevermind, I figured it out. Javascript needs to be enabled for the Android WebView. :) |
Oct 22, 2021 3:12 PM
#134
fbaierl said: Nevermind, I figured it out. Javascript needs to be enabled for the Android WebView. :) Yep, reCAPTCHA won't let you complete the procedure without enabling JS. |
Oct 23, 2021 6:38 AM
#135
I still have troubles authenticating correctly - I explained my problem in more detail on StackOverflow: https://stackoverflow.com/questions/69686648/oauth2-authorization-to-my-anime-list-not-working If anyone has any idea as to why the Mal4J authentication returns a 400 error, I would greatly appreciate any hints as to why that happens. :) |
Oct 23, 2021 1:53 PM
#136
Oct 23, 2021 3:03 PM
#137
I didn't have time to test any of this, but "%7E" translates to "~", which is a valid character according to the standard. Also, an invalid Code Challenge would give you an error during the previous phase of the authentication process and not during the token negotiation. Still, it may be worth trying a simpler string as Code Challenge (e.g. AAAAA...). @fbaierl, can you try negotiating the token using a different language or a tool like Insomnia or Postman? It should help to pinpoint the cause of the error. It's weird that MAL returns a 400 status code without any kind of error in the body. |
ZeroCrystalOct 23, 2021 3:13 PM
Oct 23, 2021 3:37 PM
#138
I’m aware that %7E is ~, the sample from the stack overflow shows %7E instead of ~. My thinking is that passing that encoded verifier to the MAL Authenticator would cause an issue because that constructor also encodes the data. In other words, passing an encoded verifier to that constructor would encode it again causing the resulting verifier to be malformed. |
Oct 23, 2021 4:10 PM
#139
KatsuteDev said: I’m aware that %7E is ~, the sample from the stack overflow shows %7E instead of ~. My thinking is that passing that encoded verifier to the MAL Authenticator would cause an issue because that constructor also encodes the data. In other words, passing an encoded verifier to that constructor would encode it again causing the resulting verifier to be malformed. I don't know the internals of Mal4J so I'll trust you. Thanks for the note. Once again, @fbaierl, can you try using a simpler, static string for the Code Challenge? |
Oct 24, 2021 5:35 AM
#140
ZeroCrystal said: KatsuteDev said: I’m aware that %7E is ~, the sample from the stack overflow shows %7E instead of ~. My thinking is that passing that encoded verifier to the MAL Authenticator would cause an issue because that constructor also encodes the data. In other words, passing an encoded verifier to that constructor would encode it again causing the resulting verifier to be malformed. I don't know the internals of Mal4J so I'll trust you. Thanks for the note. Once again, @fbaierl, can you try using a simpler, static string for the Code Challenge? StackOverflow had the correct answer for my problem: When specifying redirect_uri in the authorization request, one must apparently do the same for the token request. After removing this parameter from the first call, everything works as expected. Thanks everyone! |
More topics from this board
» Requesting additional authorizationsSomeNewGuy - Aug 18 |
1 |
by ZeroCrystal
»»
Aug 22, 8:31 AM |
|
» Scraping from HTML suggested rateDavenzo - Jan 8, 2023 |
4 |
by 7k72
»»
Jun 23, 6:35 AM |
|
» Accessing Many Users' Listloukylor - Jun 11 |
0 |
by loukylor
»»
Jun 11, 3:07 PM |
|
» Caching strategy to avoid making additional API callsJakuten - Jun 3 |
4 |
by Jakuten
»»
Jun 8, 11:30 AM |
|
» Manga Update API Endpoint Disabledarturitojedi - May 15 |
0 |
by arturitojedi
»»
May 15, 6:45 PM |