wohali / oauth2-discord-new

New Discord Provider for the OAuth 2.0 Client
MIT License
118 stars 22 forks source link

{"error":"invalid_grant","error_description":"Invalid \"code\" in request."} #49

Closed LevPrav999 closed 3 months ago

LevPrav999 commented 3 months ago

Hello. I use this code:

#[Route("/login", name: "login")]
    public function login(#[MapQueryParameter] ?string $code, ClientRegistry $clientRegistry): JsonResponse
    {
        $token = $clientRegistry->getClient('discord')->getAccessToken([
            'code' => $code
        ])->getToken();

        $user = $clientRegistry->getClient('discord')->getOAuth2Provider()->getResourceOwner($token);
        return new JsonResponse(["ok" => $user]);
    }

But it returns an error: {"error":"invalid_grant","error_description":"Invalid \"code\" in request."} How can i fix it?

LevPrav999 commented 3 months ago

My url after auth looks like this: http://localhost/auth/discord/login?code=rITZ1JtyTBnSCMYdne7iw5g32iFurs&state=bbe3c754c9429c52747673d8g62bac7d

HayateLaTech commented 3 months ago

https://github.com/wohali/oauth2-discord-new/issues?q=invalid+grant

possible duplicate of #1

HayateLaTech commented 3 months ago

the issue arises when the code is used multiple times x3 it's a one-time usage, so once used, it'll get invalidated. the code snippet you showed doesn't re-use the code so I can only assume you tried reloading the page with the same code?

wohali commented 3 months ago

What @HayateLaTech said is correct. Avoid page reloading, in testing always start from the beginning of the flow.

LevPrav999 commented 3 months ago

Thanks for the answer. However, I don't use page reload anywhere.

I create gist with my code: https://gist.github.com/LevPrav999/02149874b4bd496e6423092e03d5e590 Can you help me with my problem, please?

HayateLaTech commented 3 months ago

Try debugging your application to see where it loops and triggers the

$token = $clientRegistry->getClient('discord')->getAccessToken([ 'code' => $code ])->getToken();

part of your code twice.

LevPrav999 commented 3 months ago

I have been debugging applications, there are no cycles. The code is executed once. I may have configured the framework configuration incorrectly. Now I have done there that the token is saved to the session and then taken from it. It works, but this method does not seem to me the best