I have been through the allauth setup, using default settings, and solved problems like the https issue::
ACCOUNT_DEFAULT_HTTP_PROTOCOL = "https"
DEFAULT_HTTP_PROTOCOL = "https"
And using ngrok so that I can access my development environment using::
https://7fff461c.ngrok.io/ (not real code)
And checking that the full callback works::
https://7fff461c.ngrok.io/accounts/facebook/login/callback/
And settings up Facebook with Valid OAuth Redirect URIs set to https://7fff461c.ngrok.io/ so when I enter https://7fff461c.ngrok.io in the Redirect URI Validator at the bottom of the facebook page it works...
When I try to signup link I get an error from facebook:
URL Blocked: This redirect failed because the redirect URI is not whitelisted in the app’s Client OAuth Settings. Make sure Client and Web OAuth Login are on and add all your app domains as Valid OAuth Redirect URIs
Doubled check that the redirect url being passed is correct, which it is::
decoded: &redirect_uri=https://7fff461c.ngrok.io/accounts/facebook/login/callback/&scop
What else is there to try?!
Well this is embarrassing, but I'll leave this question/answer here in case it helps anyone else.
When putting in the the Valid OAuth Redirect URIs in Facebook Login > settings it needs THE WHOLE URL!
So in this case:
https://7fff461c.ngrok.io/accounts/facebook/login/callback/
Now it's all working.
Related
I am using Google OAuth for my Django App (via allauth package)
I have followed all standard configuration steps. In Google Developer console here's what i have:
Authorized JavaScript origins
https://example.com
Authorized redirect URIs
https://example.com/accounts/google/login/callback/ - login fails
http://example.com/accounts/google/login/callback/ - login succeeds
What i observe that if i have a https redirect URL in Authorized redirect URIs, it does not allow login and it fails with redirect_uri_mismatch Error. If i have a http redirect URL then the login succeeds.
What do i need to do to have a https enabled redirect URL ?
Adding the following in production settings.py fixed the problem for me:
ACCOUNT_DEFAULT_HTTP_PROTOCOL='https'
**This worked for me :
Go to https://console.developers.google.com
Add without port http://127.0.0.1/accounts/google/login/callback/
Also Add http://localhost/accounts/google/login/callback/
see the image in the link for detail
In my case, the problem was in the following:
My website switched the access to HTTPS-only connections, while in Google API dashboard was http://profile.example.com/accounts/google/login/callback/.
So, I changed:
from http -> https and it begins to work fine.
can someone please help me. I am getting the following error when trying to login with Facebook:
URL Blocked: This redirect failed because the redirect URI is not
whitelisted in the app’s Client OAuth Settings. Make sure Client and
Web OAuth Login are on and add all your app domains as Valid OAuth
Redirect URIs.
My redirect URI is: http://127.0.0.1:8000/auth/complete/facebook
you can change your URI from this:
http://127.0.0.1:8000/auth/complete/facebook
to this:
http://127.0.0.1:8000/en/auth/complete/facebook
you can add for each tranlation you may add. (en, fr, etc)
Hope it helps.
Insecure Login Blocked: You can't get an access token or log in to this app from an insecure page. Try re-loading the page as https://
Error message says there is no SSL at your domain which you tried to use the API, but I already added it to Valid OAuth Redirect URIs so this makes no sense.
Cause validator says this is a valid redirect URI for this application and I am using a wordpress plugin named Woocommerce Social Login. Its settings also offering the valid URI.
What can be the cause now? They(FB) don't accept the Lets Encrypt SSL as an SSL anymore?
I have fixed the situation by just checkin the url requested when we try to login with facebook, it shows http instead of https. So the source of the problem is wordpress social login plugin.
https://www.facebook.com/v2.8/dialog/oauth?client_id=<ClientID>&redirect_uri=http%3A%2F%2example.com%2F%3Fwc-api%3Dauth%26done%3Dfacebook&response_type=code&scope=public_profile%2C%20email
I am developing a web application using Django and python-social-auth. I want users to login with Facebook.
I have this in my python settings:
SOCIAL_AUTH_FACEBOOK_KEY = '...'
SOCIAL_AUTH_FACEBOOK_SECRET = '...'
SOCIAL_AUTH_FACEBOOK_SCOPE = ['email']
When my users enter the facebook page where they should provide credentials they see an error like this:
Can't Load URL: The domain of this URL isn't included in the app's domains.
To be able to load this URL, add all domains and subdomains of your
app to the App Domains field in your app settings.
In Facebook for Developers dashboard I have added "Facebook Login" product and added redirect url:
http://localhost:8000/complete/facebook/
In settings, Website Site URL is set to: http://localhost:8000/ and App Domains is set to localhost.
What am I doing wrong?
BTW this is the url that my users see when the facebook page opens:
https://www.facebook.com/v2.9/dialog/oauth?scope=email&state=HSfkstGUR5028DMhUzfWOSgo6fpPx29E&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Fcomplete%2Ffacebook%2F%3Fredirect_state%3DHSfkstGUR5028DMhUzfWOSgo6fpPx29E&client_id=...&return_scopes=true
Disable the 'Use Strict Mode for Redirect URIs' setting in your Facebook login app.
OR
Note the redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Fcomplete%2Ffacebook%2F%3Fredirect_state%3DHSfkstGUR5028DMhUzfWOSgo6fpPx29E parameter of generated url.
For some inexplicable reason Facebook requires Valid OAuth redirect URIs setting to be exactly the same as the redirect url.
So use a tool like https://meyerweb.com/eric/tools/dencoder/, decode the url and set Valid OAuth redirect URIs to the full url. I.E:
http://localhost:8000/complete/facebook/redirect_state=HSfkstGUR5028DMhUzfWOSgo6fpPA59E
Upgrading social-auth-core to at least version 1.6.0 should help to resolve this. Among other changes it includes this one:
Default REDIRECT_STATE to False in FacebookOAuth2 backend.
This was changed as a result of issue 141, and it causes redirect URLs to be generated without the redirect_state argument, whose dynamic value makes whitelisting impossible.
Once you've done this, add https://<your-domain>/complete/facebook/ to your OAuth redirect whitelist in the Facebook developer portal.
Facebook doesn't like localhost in the Redirect URI field in the app setup or in the redirect_uri parameter. To workaround it just set something in the field (I use http://myapp.com:8000, then add the entry 127.0.0.1 myapp.com in your /etc/hosts and access the app through the new URL (http://myapp.com:8000).
As of the 4th April 2018, day i face the same issue, the only solution i found is:
Valid OAuth redirect URIs must be set to be exactly the same as the redirect url
More info here: https://developers.facebook.com/blog/post/2017/12/18/strict-uri-matching/
I've added facebook login to my site. However, when I click the signin button, I get a red box that says:
'Given URL is not allowed by the Application configuration.: One or more of the given URLs is not allowed by the App's settings. It must match the Website URL or Canvas URL, or the domain must be a subdomain of one of the App's domains.'
When I dig deep, I find that my Nginx server is sending a request to facebook from http://mydomain.com:8001/usersignin, I believe facebook doesn't accept :8001 in the URL, How can I prevent :8001 appending to the URL ?
See the port_in_redirect directive