GNOME Bugzilla – Bug 591455
Authentication fails if not already logged into Snowy
Last modified: 2009-10-04 00:48:03 UTC
When using Tomboy 0.15.4 to sync with Snowy (git master / 1 days old) the following problem occurs: - In preferences enter url of Snowy. E.g. http://localhost:8000 - Click on "Connect to server" - Browser opens with login page - Enter username & password - Snowy redirects to: http://localhost:8000/accounts/profile/ - The webpage is 404 - Page not found If you are already authenticated with Snowy, it works as expected. Snowy is asking you whether or not to grant access.
I confirm this bug, using Firefox and the latest snowy. The funny thing is, this doesn't happen with the Android browser, it redirects just fine to the token authentication page. Below are the Snowy logs for the Android and Firefox. Firefox: [05/Sep/2009 05:36:11] "GET /oauth/authenticate/?oauth_token=ddPHzCxQuvqSYWyRfu&oauth_callback=http://www.google.com HTTP/1.1" 302 0 [05/Sep/2009 05:36:12] "GET /accounts/login/?next=/oauth/authenticate/%3Foauth_token%3DddPHzCxQuvqSYWyRfu%26oauth_callback%3Dhttp%3A//www.google.com HTTP/1.1" 200 2372 [05/Sep/2009 05:36:23] "POST /accounts/login/ HTTP/1.1" 302 0 [05/Sep/2009 05:36:24] "GET /accounts/profile/ HTTP/1.1" 404 3185 Android: [05/Sep/2009 05:37:51] "GET /oauth/authenticate/?oauth_token=F5VWRanc2JmKk5xuAc&oauth_callback=tomdroid%3A%2F%2Fsync HTTP/1.1" 302 0 [05/Sep/2009 05:37:53] "GET /accounts/login/?next=/oauth/authenticate/%3Foauth_token%3DF5VWRanc2JmKk5xuAc%26oauth_callback%3Dtomdroid%253A%252F%252Fsync HTTP/1.1" 200 2372 [05/Sep/2009 05:38:07] "POST /accounts/login/ HTTP/1.1" 302 0 [05/Sep/2009 05:38:09] "GET /oauth/authenticate/?oauth_token=F5VWRanc2JmKk5xuAc&oauth_callback=tomdroid%3A%2F%2Fsync HTTP/1.1" 200 3384
Technically, I think you are authenticated, but the /accounts/profile page is missing. This should be easy to rectify.
I'm not sure creating the accounts/profile page will solve the problem. When you look at contrib/auth/views.py:23 in the django source [0], it checks for a double slash, thinks the redirection url is garbage and redirects to a default settings page. This isn't really a problem with snowy, but with the client. Html-escaping the callback url fixes the problem. [0] http://code.djangoproject.com/browser/django/trunk/django/contrib/auth/views.py
You're right, Benoit. The /accounts/profile redirect is just the default behavior after you log in. In 30da43a, I've made it so that it redirects to /, but the main problem, as you've discovered, is that Tomboy isn't urlencoding the callback url. Retargeting to Tomboy so Sandy will see it.
urlencoding the callback URL definitely fixes this, good catch guys. I'll push this fix with the fix for bug #594046, which is blocking on string freeze breakage approval.
Fixed in 0.15.7.