Ask HN: Does anyone else have problems with Instagram API OAuth2?

Re:Ask HN: Does anyone else have problems with Instagram API... by xmrcivicboix on Saturday December 17, 2016 @10:52AM (#13201093)

To temporary fix the issue, you could do the following:

change response_type=code to response_type=token. Instagram will redirect back to your site with something like /callback#access_token=123456. From here, send the user to a very simple page with the following snippet:

    if (window.location.hash && window.location.hash.indexOf('#access_token=') !== -1) {
        var accessToken = window.location.hash.replace('#access_token=', '');
        window.location = '/callback?access_token=' + accessToken;
    }

</script>

After that, you just use the Instagram API to retrieve user by access token then perform log in. This is not a recommended flow by Instagram but is a flow that works for now if your customers are constantly hammering you with support tickets as they did with us.

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by goddamnyouryan on Tuesday December 20, 2016 @06:08PM (#13225192)

Anyone have any experience getting this working with omniauth? It seems like one ought to just be able to change the config to:

    provider :instagram, ENV['INSTAGRAM_CLIENT_ID'], ENV['INSTAGRAM_CLIENT_SECRET'],  response_type: 'token'

But that doesn't seem to be working

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by jontrausti on Monday December 19, 2016 @06:00PM (#13215763)

Thanks for this temporary fix. Going to use it until Instagram fixes their issue with the authorization code.

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by AlexWhite_ on Saturday December 17, 2016 @11:33AM (#13201250)

This solution is insecure. Any person can intercept token and make harm to your application.

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by xmrcivicboix on Saturday December 17, 2016 @07:30PM (#13203614)

I completely agree. Hence I said it's temporary. When you have a huge influx of paying customers who cannot log in to do their work, you have to balance that a bit.

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by svens_ on Monday December 19, 2016 @08:27AM (#13211211)

It doesn't seem too bad when enforcing https (using the return address whitelisting in the developer console). Am I missing something?

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by AlexWhite_ on Monday December 19, 2016 @04:31PM (#13215140)

Customer will see token anyway

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by svens_ on Monday December 19, 2016 @06:51PM (#13216098)

Ah yes, of course. I did miss that. The implicit (client-side) auth flow gets the access token directly and doesn't need another request to the API, that's the whole point.

This is indeed rather unwanted, even more so with the new more restrictive API usage policy and the sandbox.

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by vikaton on Saturday December 17, 2016 @08:39PM (#13203859)

Where would I change response_type=code to response_type=token?

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by xmrcivicboix on Saturday December 17, 2016 @09:36PM (#13204007)

When you generate the server side explicit flow, it looks something like this:

https://api.instagram.com/oauth/authorize/?client_id=CLIENT-...

Depending on the library you use, it may be default to response_type=code. Just get the URL and do a search and replace if the library doesn't allow you to define the type.

See https://www.instagram.com/developer/authentication/

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by vikaton on Saturday December 17, 2016 @10:34PM (#13204169)

I use this library: https://github.com/jaredhanson/passport-oauth2

Something tells me however that just changing it to 'token' (file strategy.js, line 217) actually fixes it, now there are other issues with many redirects when just changing that line, Im not entirely sure how that library works to fix anything else at this point, do you know when this issue might be resolved as a whole?

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by xmrcivicboix on Sunday December 18, 2016 @10:43AM (#13206151)

Unfortunately, Instagram is terrible with responding to developer support tickets and there really isn't a much of a community aspect around it. This issue itself is not easily reproducible. The same account may work on one site and not a another site.

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by AlexWhite_ on Saturday December 17, 2016 @07:25PM (#13203585)

but this is better than nothing, thank you!

[ Parent | on HN ]

Re:Ask HN: Does anyone else have problems with Instagram API... by vikaton on Saturday December 17, 2016 @08:59PM (#13203909)

How did you go about this solution?

[ Parent | on HN ]