Invalid OAuth access token when trying to login using facebook [#1981228]

Hi,

When i try to login using facebook on drupal site with facebook session opened in another tab, it shows "Invalid OAuth access token." error message. Though same thing works fine when facebook session is logged out.
In the url it generates, there is oauth_token parameter. If i remove this parameter from query string, then also it works.

Why is oauth connector is putting this oauth_token parameter? I checked another implementation of oauth login in php. The url it generates does not have oauth_token and therefore works fine.

Comment	File	Size	Author
	error.png	6.29 KB	Anonymous (not verified)

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

Sumeet.Pareek CreditAttribution: Sumeet.Pareek commented 29 April 2013 at 10:45

Weird thing is that I see the same error on my site where login via oauth connector + FB was working fine the last time I checked, and nothing there has changed since then.

This patch, though not ideal (as some in the comments have suggested) fixes the problem. - http://drupal.org/node/1963174

Wondering how this bug(?) popped up automatically?

Comment #2

Anonymous (not verified) CreditAttribution: Anonymous commented 1 May 2013 at 09:36

Yeah, the same thing with my site. I think it's something with FB API for OAuth. But I'm not sure. The reason may be that, as I can see, this module doesn't support OAuth 2.0 (which is using by FB) and OAuth Connector is using its own implementation ("high-level" handlers) for OAuth 2.0. But GET request is provided by OAuth module and it's not corresponds to the OAuth 2.0 standarts (specifically it's adding unnecessary parameter "oauth_token") and FB handler mistakenly takes it as a "access_token".
I've browsed FB developers recent blog posts but couldn't find anything about changes to OAuth API.

This patch, though not ideal (as some in the comments have suggested) fixes the problem. - http://drupal.org/node/1963174

I'm using that patch but I think that developers of OAuth module need to know about this bug (although I'm not sure this bug refers to the module).

Comment #3

gibry21 CreditAttribution: gibry21 commented 27 May 2013 at 11:57

Subscribing to this....

Broke out of the blue on my site. Most important thing here is that this is being used in the new Kickstart 2.0 distribuition and therefore breaks the social login feature which they are using as a feature.

I'll try the patch but think next release should look at a fix to bring the module in line with FB new standards

Cheers

Comment #4

hmartens CreditAttribution: hmartens commented 28 May 2013 at 08:49

I've been struggling for a week now to get the FB login working to no avail :) But the twitter login works beautifully!

When I try to login, it gives me the
"AUTHORIZATION FINISHED

The application has been authorized" message but I'm still not logged in or taken to a registration page. I also see in the addressbar the following: "/oauth/authorized2/3?error_code=190&error_message=Invalid+OAuth+access+token.#_=_"