Ask HN: Does anyone else have problems with Instagram API OAuth2? |
Ask HN: Does anyone else have problems with Instagram API OAuth2? |
Trouble is, we can't faithfully reproduce the issue from our network, but clients are reporting failures to authenticate every time they try!
Have contacted Instagram for an update. Anyone else still experiencing the issue?
Thank you!
change response_type=code to response_type=token. Instagram will redirect back to your site with something like /callback#access_token=123456. From here, send the user to a very simple page with the following snippet:
<script>
if (window.location.hash && window.location.hash.indexOf('#access_token=') !== -1) {
var accessToken = window.location.hash.replace('#access_token=', '');
window.location = '/callback?access_token=' + accessToken;
}
After that, you just use the Instagram API to retrieve user by access token then perform log in. This is not a recommended flow by Instagram but is a flow that works for now if your customers are constantly hammering you with support tickets as they did with us.
provider :instagram, ENV['INSTAGRAM_CLIENT_ID'], ENV['INSTAGRAM_CLIENT_SECRET'], response_type: 'token'
https://api.instagram.com/oauth/authorize/?client_id=CLIENT-...
Depending on the library you use, it may be default to response_type=code. Just get the URL and do a search and replace if the library doesn't allow you to define the type.
Here's my fork for the omniauth-instagram Ruby gem, which is now allowing me to consistently log in: https://github.com/stefl/omniauth-instagram/blob/master/lib/...
I kept getting "Matching code was not found or was already used." when using thru my oauth python code which btw has been working for 6 years now. But when I used curl to do POST, it worked, when I tried Curl again with same oauth code, it failed, So I think this is something that was recently changed by Instagram, the oauth code only works one time, I kind of remember this code could be used more than once before to make POST call, but there was time limit instead, after which using same code was failing.
So with me, this was always failing, but no complains from my customers, I could see logs that new people were signing up.
I started testing on localhost, I added debug logs, I did notice that there was 2 POST calls being made, so it was failing. I could see that 2 POST calls was made and first one did work and get access_token, but there was a second call made and this was error 400 and oauth flow was failing. Almost looked like a retry of POST call, cause my code should only make one.
I started trying different browsers, failed on all firefox,IE, safari, chrome. And then decided to try on my iphone, it worked 100%, so looked for difference, it was on LTE, so I guessed may be my wifi, switched to wifi on iphone and it started failing 100%. So now on my dev system, I connected modem directly to system without router and tried, it passed 100%, so it was my wireless router (I know weird), I tried another 3rd party instagram web app, had same issue but worked without the wireless router. So on Monday I got another wireless router and no issues, it started working. So this could be an isolated incident for me, I came to conclusion that I was using some old router that was dropping POST request and making second attempt and failing.
So I guess if this is affecting all your customer check you code by putting logs that you are making one POST request. Try making a CURL after you receive the code and make sure it is working on first attempt.
Today after reading this, I check my oauth login again, I did notice it fail few times, but when I try again, it is passing, so something changed again I think.
1. It not depends on IP of API server behind instagram load balancer 2. It appears on ipv4 and ipv6 both 3. Problem not depends on delay between request code and exchanging this code for token 4. Logout and login helps sometimes
Reported issues but haven't heard back
"report issue" button
Apparently it happens from time to time, there are some posts about this problem on StackOverflow. No answers though.
We tried many things, including resetting our secret. It's working now, but it's hard to tell whether our actions had any effect.
Instagram had a long period of time it went down yesterday I'd be surprised if they aren't linked.
I honestly wish it was something like this, at least then we could fix it.
The double POST requests you see is most probably because api.instagram.com returns a 302 response ("Found", i.e. redirect). This is a relatively recent change, but still weeks before those issues started.
By the way, your server refuses connection when you go to https://picodash.com directly (without www.). You might want to fix this.
This is indeed rather unwanted, even more so with the new more restrictive API usage policy and the sandbox.
Something tells me however that just changing it to 'token' (file strategy.js, line 217) actually fixes it, now there are other issues with many redirects when just changing that line, Im not entirely sure how that library works to fix anything else at this point, do you know when this issue might be resolved as a whole?
At least not in all cases, i.e. we tried production, staging and an instance running on localhost. Private mode usually changed in which places the login worked, but it never helped for all three.
It's a bit frustrating with no reaction from Instagram/Facebook and not even an entry on the status page.