[instagram-feed] token invalid

[guardsecab]

The instagram token will not refresh for me, even if I do the manual steps with logging in to instagram and allowing my account, and the refresh screen gives a successful message that the token has been refreshed, in the plugin it is still marked as 'invalid' and the plugin is not working on the webpage.

Please see screen recordings below: https://user-images.githubusercontent.com/131950468/234786370-efc42059-ddd5-40be-b1e0-1971684ed17c.mov

[rhukster]

Ok i see the token is getting regenerated as evidenced by that "you can close this tab" page where the new token is output. If you look at the end of that new token it ends in ONHJR. When you reload the admin page, it still shows the token ending in KOFhR. So it's not showing the updated token.

While I look into the actual saving logic, can you tell me if you have environemental configuration setup? (https://learn.getgrav.org/17/advanced/environment-config#automatic-environment-configuration)

This can cause a different configuration file to be updated compared to the one you are viewing in the admin.

[guardsecab]

I have not setup any environmental configuration to my knowledge. But as far as I can see there are an old development installation in the /grav folder on my server. Reaching this with my browser seems to render the plugin correctly. Not really sure as to why that is, as I had help from a developer with setting the plugin and final installation up.

[rhukster]

Well, i just tested this on my local environment where I had an expired token, and the process worked 100% and saved the newly generated token. My thought now is that the token is just not being saved.

Can you confirm that your user/data/instagram-feed/token.txt file is writable by your webserver?

[guardsecab]

The permission setting on the server is 0644.

ROOT/user/data/instagram-feed/token.txt still contains the old token.

BUT the other (development) installation I found in a subfolder is containing the new token. So it seems like the token is saved to

ROOT/grav/user/data/instagram-feed/token.txt instead of the path above were the live site is.

[guardsecab]

I did move the key from the /grav path over to the root path, and now it works. So it is definitely something making the new token saved at a subfolder rather than root level. The site was under development in this subfolder, and later moved to root when finished. Any hints on how to fix the issue. The installation on the subfolder would no longer be needed, if this helps to remove.

[rhukster]

I can't really say what's causing that other than your webserver configuration. Grav should always 'know' where it is and save in the correct location. The fact that your token is saved in a different location tells me that something is awry in that webserver/vhost setup with perhaps conflicting entries pointing to different paths?