redirect_uri_mismatch

[collinsmarra]

redirect_uri_mismatch

[ctron]

When navigating the browser to the OAuth2 server (Google in this case) it adds a parameter to the request which tells the OAuth2 server where to redirect to, after a successful authentication. In most cases this URL must be explicitly allowed through some configuration.

I am not sure how this works exactly with Google, but in Keycloak and GitHub you have some fields to put in the URL. The URL is discovered by yew-oauth2 from the browser:

yew-oauth2/src/agent/mod.rs

Lines 378 to 384 in 5c0b412

	fn current_url() -> Result<Url, String> {
	let href = window().location().href().map_err(|err| {
	err.as_string()
	.unwrap_or_else(|| "unable to get current location".to_string())
	})?;
	Url::parse(&href).map_err(|err| err.to_string())
	}

You should be able to see the URL in the request send to the Google OAuth2 endpoint (it's URL encoded), and this URL should be allowed on the Google side. For Keycloak it is possible to use wildcards (*) to work allow patterns or URLs. That sometimes helps with localhost URLs and random ports. It depends on your OAuth2 implementation how and if this is enforced, and what can be configured.

[collinsmarra]

Thank you. I added both http://127.0.0.1:8080 and http://localhost:8080 as the redirect uri and it seemed to have fixed the error. However, this is the result.

This is the response from google servers

But I know I am not supposed to pass in the client secret at this point, because the token is to be taken to the backend to be used there. Could I be missing anything here?

[ctron]

Cool. You need to set up a client with doesn't require a secret. As this is a web/frontend application, you can't use a secret. In Keycloak terminologies this is a "public client". Not sure how that is called in Google-land.

But if you figure it out, it would be great to let me (any possibly others) know 😀

[collinsmarra]

I do get the redirect, which is fine. But I think in this case yew-oauth2 tries to exchange something with the google servers without the client_secret. So I get the error.
But for my needs, I wanted to dump the JWT code from google so I can parse them to the backend. That is where I could use the client_secret, decode the code, get the needed info and then issue a user new fresh tokens from my own backend.

[ctron]

When using yew-oauth2, we are talking about a "public client": https://oauth.net/2/client-types/ … that does not involve a "client secret" as it cannot be kept confidential/secret.

This has been discussed before: #3 (comment) and following … maybe take a look. I think it also mentions/links to Google documentation regarding this.

When communicating with Google APIs, I would expect to only forward the access token (which your backend received from the frontend).

[ctron]

Here is the link to Google's documentation: https://developers.google.com/identity/protocols/oauth2/javascript-implicit-flow#oauth-2.0-endpoints

[ctron]

Can we close this one?