Reddit OAuth2 401 Client Error Unauthorized

[mbmccoy]

Ran into a 401 issue today when using psa for Reddit with python3. The bug arises from unicode/byte problems (surprise! It's python3).

Basically, the RedditOAuth2 backend authentication header is malformed because

' {} '.format(b'byte_string') == " b'byte_string' "

Note the extra enclosing " ". I hacked around the problem by replacing the following in reddit.py:

class RedditOAuth2(BaseOAuth2):
    (...)
    def auth_headers(self):
        # Reddit uses HTTPBasic authentication; throw into header
        auth_header = b'Basic ' + base64.urlsafe_b64encode(
            '{0}:{1}'.format(*self.get_key_and_secret()).encode()
        )
        return {'Authorization': auth_header, }

Of course, this won't work if the key and/or secret are byte strings.

On a philosophical level, it seems to me that the "right" way to solve this problem is to require that all URIs, application keys, client secrets, etc. be binary strings (since, if I understand correctly, that's what they really are).

But don't try this right now or you'll run into a world of hurt. For example, you'll get this problem in the StripeOAuth2 backend if a developer encodes the client secret as a byte string.

-Mike

[omab]

Closing, too old, and not a problem at the moment. Reopen if needed.

[chadmiller]

Still a problem. Please re-open.

In debug page shown because of exception, a few frames from the end, showing local variables:

social/backends/oauth.py in request_access_token

kwargs    {
   'auth': None,
   'data': { 'client_id': 'zhFG9g',
             'client_secret': 'ssJb3WWrttdz6I',
             'code': 'nBOjFdLuqNM4k',
             'grant_type': 'authorization_code',
             'redirect_uri': 'http://boogs.example.com/redirect/reddit'},
   'headers': {'Authorization': 'Basic '
                              "b'emhGdHp6YmtyeDVNBZmFqdFdydHRkejZJ'",
             'User-Agent': 'python-social-auth-0.2.12'},
   'method': 'POST'}

[chadmiller]

This seems more likely to be right. Note ".decode()"

 43     def auth_headers(self):
 44         return {
 45             'Authorization': 'Basic {0}'.format(base64.urlsafe_b64encode(
 46                 ('{0}:{1}'.format(*self.get_key_and_secret()).encode())
 47             ).decode())
 48         }

[jackfischer]

Please re-open, also looks like there may be other pull requests, #772 and #782?