dynamic parameter on redirect_uri for fitbit

Hello

To connect to Fitbit with oauth 1.0a, I use this redirect uri :
{MY-REDIRECT-URL}?client_id={NUMBER}&branding={STRING}&date={DATE}

This method doesn't work for oauth2.0 because fitbit doesn't accept pattern for callback URL.
We need to use state parameter for this. Fitbit will append this parameter to the redirect_uri

Source :
community.fitbit.com/t5/Web-API/OAU ...

I'm looking for a solution for that. Do you knoaw how i can do that ?

Thanks a lot.

I am not sure what you mean.

The OAuth class sets the state parameter in the redirect URL when redirecting to the OAuth 2.0 server.

As you may see in oauth_configuration.json it has the format:

fitbit.com/oauth2/authorize?client_ ...

The state parameter is used internally to validate the request when the OAuth server redirects back to your site. The state parameter is not supposed to be set by your value of redirect_uri variable.

Maybe you should enable the debug support, capture the PHP error log and post it here so I can try to see what may be wrong.

Hello,

Here is what I want to use for redirect_uri :
- https://www.mywebsite.com/fitbit/?date=2015-10-29&client_id=138218&branding=1
- https://www.mywebsite.com/fitbit/?date=2015-10-28&client_id=123456&branding=4
- https://www.mywebsite.com/fitbit/?date=2015-10-17&client_id=123456&branding=4

If I use this as callback url on fitbit (Application setting) :
mywebsite.com/fitbit/
It works for Oauth 1.0a.
It doesn't work for Oauth 2.
I have the following message: invalid_request - Invalid redirect_uri parameter value

If I understand the Fitbit forum, they block the use of pattern on redirect_uri for reasons of safety and advise using the STATE parameter for this.

If this isn't possible like this, I'll try an alternative solution using sessions.

Fitbit does not accept that redirect_uri because it must be exactly what you informed when you created the application.

So it does not allow different URLs, even if the difference is in the URL parameters.

I think you can workaround that using session variables.

Hello,

At first, I didn't want to use session because I need to use cross-domain in my application.

Finally, I added a step invisible for clients in my code to use session. My code works with this solution.

Thank a lot for your contribution.

Jerome, can you share your code?