search

superseriousbusiness / gotosocial

Fast, fun, small ActivityPub server.
https://docs.gotosocial.org
GNU Affero General Public License v3.0
3.83k stars 331 forks source link

[bug] Can't authorize trakt.tv - invalid credentials #3542

Open Karmalakas opened 4 days ago

Karmalakas commented 4 days ago

GTS v0.17.3 on TrueNAS Scale 24.10

So I want to authorize a web app to post on my behalf (trakt.tv in this specific case). Here are the steps:

  1. On their page I enter my instance domain and I get redirected to https://my.instance.tld/oauth/authorize?client_id=01F...&redirect_uri=https%3A%2F%2Ftrakt.tv%2Fauth%2Fauth%2Fmastodon%2Fcallback&response_type=code&scope=read%3Aaccounts+write%3Astatuses&state=afc...
  2. Then instant redirect to https://my.instance.tld/auth/sign_in where I enter my account credentials and submit
  3. I'm redirected to https://my.instance.tld/oauth/authorize where I'm greeted with the message about scopes and "Allow" button
  4. After I click "Allow", I'm redirected back to https://trakt.tv/auth/auth/mastodon/callback?code=ZTK...&state=afc... where I get "invalid credentials" message

I don't have any problem authorizing this app with botsin.space account - works flawlessly 🙄

Could it be, that in the background Trakt makes a https://my.instance.tld/api/v1/accounts/verify_credentials request which fails with "invalid credentials"?

Could it be simply because of scopes? read:accounts write:statuses instead of just read write?

Is there anything I could investigate myself? I checked the logs, but didn't notice anything (I might've missed something because it's flooded with irrelevant entries)

I talked to Trakt support, but they say there's not much they can do 😞

P. S. I managed to authorize a couple of other apps, although there are other issues, which I'll submit later

tsmethurst commented 4 days ago

Hiya, if GtS is redirecting you back to the app's redirect_uri then there won't be any helpful logs because as far as GoToSocial is concerned, everything works as expected. Maybe trakt.tv doesn't like something about the code or state that's being provided in the query parameters, but I've no clue what it might be objecting to, or why. Is that an open source project, do you know? If so we could just have a look at the code for handling callbacks and see what it's trying to do.

Karmalakas commented 4 days ago

Is that an open source project

Unfortunately, no. I've asked their developer if it would be possible to get more info

tsmethurst commented 4 days ago

Alright, cheers, keep us in the loop :) If this points to an OAuth bug on our side that's something we can look at fixing.