Google OAuth Code Contains Hashtag - coldfusion

Question

In my attempts to get the necessary code so I can generate my refresh token, I ran this URL:
https://accounts.google.com/o/oauth2/auth?scope=https://www.googleapis.com/auth/drive.file&redirect_uri=--mywebsite--&response_type=code&client_id=--myclientid--
And my received code contains a trailing hash tag, which throws an (expected) error when I try to execute:
<cfhttp url="https://accounts.google.com/o/oauth2/token" method="post">
<cfhttpparam name="code" value="4/UXF5F5TlIuFsXrav-DvIrebMR8NST9WK-EPmThmx7l0#" type="formfield"> <!-- Sample code value -->
<cfhttpparam name="client_id" value="--myclientid--" type="formfield">
<cfhttpparam name="client_secret" value="[client secret]" type="formfield">
<cfhttpparam name="redirect_uri" value="--mywebsite--">
<cfhttpparam name="grant_type" value="authorization_code" type="formfield">
</cfhttp>
ColdFusion was looking at the following text:formfieldThe CFML compiler was processing:An expression that began on line 2, column 86.The expression might be missing an ending #, for example, #expr instead of #expr#.The tag attribute value, on line 2, column 34.A cfhttpparam tag beginning on line 2, column 10.
I tried adding a second hashtag to make it literal but I receive { "error" : "invalid_grant", "error_description" : "Invalid code." } response.
Am I missing something painfully obvious here? The tutorial I was following is at http://www.brandiandjohn.com/post.cfm/oauth-2-google-and-cfml-without-cfoauth

Answer 1

In order to continue with the existing code, you need to escape #. You can do that, by adding an extra # at the end. For eg
<!---
<cfset value="4/UXF5F5TlIuFsXrav-DvIrebMR8NST9WK-EPmThmx7l0#">
<cfoutput>#value#</cfoutput>
Error
--->
<cfset value="4/UXF5F5TlIuFsXrav-DvIrebMR8NST9WK-EPmThmx7l0##">
<cfoutput>#value#</cfoutput>
Output: 4/UXF5F5TlIuFsXrav-DvIrebMR8NST9WK-EPmThmx7l0#
So, you can try the below code:-
<cfhttp url="https://accounts.google.com/o/oauth2/token" method="post">
<cfhttpparam name="code" value="4/UXF5F5TlIuFsXrav-DvIrebMR8NST9WK-EPmThmx7l0##" type="formfield"> <!-- Sample code value -->
<cfhttpparam name="client_id" value="--myclientid--" type="formfield">
<cfhttpparam name="client_secret" value="[client secret]" type="formfield">
<cfhttpparam name="redirect_uri" value="--mywebsite--">
<cfhttpparam name="grant_type" value="authorization_code" type="formfield">
</cfhttp>

Answer 2

The hashtag error was a red herring. I got around this by making the call to get the code and then the access token as a single action. By passing in url.code I received the necessary credentials.
<cfhttp url="https://accounts.google.com/o/oauth2/token" method="post">
<cfhttpparam name="code" value="#url.code#" type="formfield">
<cfhttpparam name="client_id" value="--myclientid--" type="formfield">
<cfhttpparam name="client_secret" value="[client secret]" type="formfield">
<cfhttpparam name="redirect_uri" value="--mywebsite--">
<cfhttpparam name="grant_type" value="authorization_code" type="formfield">
</cfhttp>
<cfdump var="#foo.filecontent#">
Manually pasting the code into the cfhttpparam tag, even without the hashtag, would throw a 400 error. This way, it does not.

Answer 3

The user agent that sent you the code should have stripped the "#" character, see: Google OAuth service redirects to URL with a # sign at the end. Apparently it did not (and as such that user agent is broken) but you can strip it manually in your code before sending if off.