[solved] ManiaConnect: invalid_grant random errors

[m4rcel]

When looking through the Errors which have been logged by my Tetris ManiaLink, I came across the following one:

ManiaConnect Exception: invalid_grant: The provided access grant is invalid, expired, or revoked (e.g. invalid assertion, expired authorization token, bad end-user password credentials, or mismatching authorization code and redirection URI).

My question to this is: What could be the real cause of this error?

I am asking this, because I think the named causes cannot be fulfilled by a ManiaLink:
"Invalid assertion" may be a server side error.
"Expired authorization token" cannot happen, as I never specify any token, and thus the new created one should always be valid.
"bad end-user password credentials" cannot happen on a ManiaLink, as the user does not have to enter his or her password.
"mismatching authorization code" - I don't know what could be meant with this.
"redirection URI" is correct, otherwise nothing would work on Tetris ^^

Additionally, Whenever I use ManiaConnect, I redirect the user to somewhere else, so browisng back in history never would initiate a ManiaConnect-request again.

(I can currently not reproduce this error, I only see that it happened few times some days ago, as Tetris logs all errors and warnings into a file. This error is also not damaging anything, as it get catched away correctly and Tetris can continue normally, but no error is still better than an harmless one )

[gouxim]

Hey,

We actually had the same problem and we recently figured it out. When you finish the round trip through the maniaconnect gateway, you have a "code" parameter in the URL. Now imagine a user closes the Manialink browser, and his session expires. When he opens it again, session has ended but there is a "code" parameter in the URL so the application thinks it just ended a round trip through the maniaconnect gateway and check the "code" again: in that case you'll get an invalid_grant error.

Here's what I did in ManiaLib to fix the issue:

• Before redirecting to login URL, I create a nonce parameter and I put it both in the session and the URL: http://code.google.com/p/manialib/sourc ... ter.php#99 line 99
• Then when I check the code, if the param is in the URL, it has to match what is in the session ; if the sessions has expired, the match fails and I redirect to the login URL for a new authentication round trip: http://code.google.com/p/manialib/sourc ... ter.php#53

Hope it helps

[m4rcel]

Thank you for this information

With this, I was able to very simple reproduce this error: You only have to add any value as code parameter to the URL, where ManiaConnect would redirect back to, so e.g. http://localhost/script.php?code=42 . Now I can go ahead and fix this error