Search code examples
cordovadotnetopenauthchildbrowser

'400 Bad request' - Google not redirecting back correctly after Authentication using DotNetOpenAuth and PhoneGap ChildBrowser plugin

I'm working on a simple implementation of THIS DotNetOpenAuth tutorial.

On a regular browser such as Chrome, Firefox and IE it works fine. But when I call this "google_login.aspx" page from the PhoneGap childBrowser plugin It fails.

Failure happens in the form of a 400 -Bad Request - Invalid URL after the user has put his credentials into Google.

When Google tries to redirect back to my site, Google trying to use a bad url which looks like this:

https://myurl.com/(F(8g0QkKd61D6yBbN2pkuZwAXOTGChqwruytA0LCC_nZko2mXgddbDhT3nXCj3XWVwOSkyfNGENHtctVXbnAyFQcj344Cai3rrkKKO_SNM_laGIqIPN2pkSBJQQYc98T0qv_gZbm3R8Qufry7u-HLAAT_RfVpMtpbCM6sw-FLPuxxHUETRHjd8lA9DR7LKIfkMYYinZU_qLduO02f012wZ2feVi8XW479WOvrWCr_rHFAxPNEQFurrJO1rxGs1LUFzTZ4pNlgpm4LwHrv7lTtK5-adDKbQJXzFrjEAG22pNxGfKpesHNsV-m88zp20w70FtF56wppLfzadNgq7cPDlb3hIwbsA-JGI1he8low8_KWDNZev5RqtX8cPtQKpFIL0))/Default.aspx

Instead of this:

https://myurl.com/Default.aspx

This only happens on the PhoneGap childBrowser plugin, other browsers take me to the right place.

After getting the 400 bad request error I can manually browse to my homepage and it shows that I am in fact signed in, and that the simple redirect back from Google is what failed.

Anyone know how of a fix or possible workaround to my problem?

Solution:

I had to specify the returnToURL parameter in the OpenIdRelyingParty.CreateRequest : enter image description here

Solution

  • This looks like it may be ASP.NET's cookieless session support feature. If your failing scenario is one where session cookies are rejected, and if enabled in the web.config file, I believe ASP.NET will essentially store the cookie in your URLs instead, creating a kind of virtual path. Obviously something is going wrong with this though. I suggest you isolate the problem by:

    1. Turn on DotNetOpenAuth logging
    2. Collect a Fiddler2 trace of the entire login attempt

    ...to figure out where this stray path is coming from.