Handle cross-origin redirection

[francois2metz]

Handle cross-origin redirection

[francois2metz]

Hi @DriftingShadows. As far a I know, the current version of em-eventsource does not follow redirects. I'll try to fix that. So I don't know why you have a 401.
In the current release, if the server send redirect, the client stop with an explicit message.
Could you please provide more details?

[DriftingShadows]

Sorry I wasn't clear before. I get a 401 error when em-eventsource does not handle redirects properly. Let me paste directly from the Nest website.

In response to a REST API request, the Nest API server returns a redirect. The REST client detects the redirect and requests the page that the client was redirected to. Some HTTP implementations do not forward the Authorization header to the redirected URI, and this results in a 401 Unauthorized error.

For example, suppose you ask for foo.com. The foo.com server responds with a redirect to bar.com. Postman or Curl pass the Authorization header to foo and then to bar. Other HTTP implementations, such as Golang's and Python's, do not automatically pass the Authorization header to the redirected URI.

The stuff with the Authorization header is what I think is going wrong here.

[francois2metz]

Hi,

Still, the 0.2.3 version of this gem don't handle redirect, and the connection is stopped on the redirection. So the 401 may come before the redirection. The APi doc is not clear about that.

Anyway, I just pushed the 0.2.4 version, which should fix the redirection. Tell me if it works for you.

[DriftingShadows]

Alrite cool I gave it a go. The message I get now is: "Error: Unexpected response status 307".
Does that help you?

[francois2metz]

Strange as this message should only appear on the previous version. Can you check that you use the 0.2.4 version?

[DriftingShadows]

Oh sorry, I didn't change the gem file to use the correct version. After I changed it, what is weird is it worked one time and then I stopped and started it again. Now it just gives me "Error: Connection lost. Reconnecting." However, if I use the final redirected url as the event url for event source, it works flawlessly.

I'd be happy to share with you the access token such that you could test on your machine as well if you'd like. It's linked to a "virtual" Nest device so its only for testing purposes. I can share with you the access token, event url, and final redirected url.

[DriftingShadows]

This is my basic code:

 #URL = "https://developer-api.nest.com/".freeze
 #URL = "https://firebase-apiserver32-tah01-iad01.dapi.production.nest.com:9553".freeze
 #nest_client_token: c.RPL5T8AVgriEqLPHR5JxB4Vulxm58qz7weIEsLszca9whwvrpqqYwVk9lIOR3o0y1DlBLgly4xbXVzlj4vEI5Zn2rxHPlq45e7O6ORPgcfupJnF7NHWASknZCWJVVt9W9H7lT0fFlwE3GLrq

  def initialize
    @url = URL
    @token = nest_client_token
  end

  def subscribe_to_sse
    event_url = @url
    EM.run do
      Rails.logger.debug "Connecting to #{event_url}"
      source = EventMachine::EventSource.new(event_url, query = {}, headers=
                                            {'Authorization' => "Bearer #{@token}",
                                            'Accept' => 'text/event-stream',
                                            'Cache-Control' => 'no-cache' })
      source.retry = 5

      source.open do
        Rails.logger.debug "Opened connection to #{event_url}"
      end

      source.on "open" do |something|
        puts "the event stream has opened..."
      end

      source.on "put" do |something|
        puts "something has changed"
      end

      source.on "keep-alive" do |something|
        puts "no data update. just keep alive"
      end

      source.on "auth-revoked" do |something|
        puts "auth revoked"
      end

      source.error do |error|
        Rails.logger.error "Error: #{error}"
      end
      source.start
    end
    source.close
  end

The two urls at the top are the pre-redirected and redirected urls.

[francois2metz]

@DriftingShadows Hi. Thanks for the code. Could you please share the access token privately by email? it's on my github profile. Right now I get a 401.

[DriftingShadows]

I emailed you. Let me know if there's any further problems.

EDIT: there is a chance that the access token may have expired. I will report back to you when I get home.

[francois2metz]

I managed to reproduce the issue.

The issue occurs as the redirection is a cross-origin one AND keep alive is enabled. https://github.com/igrigorik/em-http-request/blob/bcba7b6e80ef9c211c7d56c90ab91a232fa6e212/lib/em-http/http_connection.rb#L180-L189

[francois2metz]

I have released the version 0.2.5 which fix the issue.

[DriftingShadows]

It works very well! Thank you so much for the help!

…

On 4 June 2018 at 03:58, François de Metz ***@***.***> wrote: Closed #13 <#13>. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#13 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Acf7NJ5YAff-0NVM_c6vCWWDZL5KHvEUks5t5COwgaJpZM4UWQLo> .