400: redirect_uri_mismatch only in production environment

[kyryloliinyk]

I've got a problem with configuring google authentication in my Rails application using devise and omniauth-google-oauth2.

After carefully following Usage secrion instructions I've added Authorized redirect URIs to settings list:

• https://<production_domain>/users/auth/google_oauth2/callback
• https://<staging_subdomain>/users/auth/google_oauth2/callback
• http://localhost:3000/users/auth/google_oauth2/callback

My config/initializers/omniauth.rb looks like:

# frozen_string_literal: true

# excluding port to pass callback whitelist from Google Auth 2.0
OmniAuth.config.full_host = Rails.application.config.full_host_oauth

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :google_oauth2,
           Rails.application.credentials.dig(:google_blog_auth, :client_id),
           Rails.application.credentials.dig(:google_blog_auth, :client_secret),
           skip_jwt: true, secure_image_url: true, path_prefix: '/users/auth'
end
OmniAuth.config.allowed_request_methods = %i[get post]

THE ISSSUE IS that authorization works well in _development and staging_ environments, but does not work in production env.

Trying to authenticate in production I'm getting:

Error 400: redirect_uri_mismatch

Request details: redirect_uri=https://<production_domain>/users/auth/google_oauth2/callback

It seems very strange to me cause mentioned callback is present in my Authorized redirect URIs to settings list.

NOTES:

• I have two AR lmodels for which I use Google authentication User and Admin. In case of Admin with the same settings everything works well. This issue is related only to User model.
• I'm using LinkedIn authentication too to authenticate User and it works well with the simillar settings.

[zquestz]

This is generally because the configured app is configured incorrectly on the Google side. Check the settings for the app associated with your client_id and make sure it matches perfectly.

[kyryloliinyk]

Thank you very much @zquestz ! It was just a mistype in credentials for production environment. Such a stupid mistake, unfortunately :(