parse-community / parse-community/parse-server
Vkontakte Adapter fails authentication.
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Issue Checklist
- [ X] I am not disclosing a vulnerability.
- [ X] I am not just asking a question.
- [ X] I have searched through existing issues.
- [ X] I can reproduce the issue with the latest version of Parse Server.
Issue Description
Vkontakte Adapter fails authentication.
When trying to use Parse to authenticate a vkontakte account holder (via Adapters/Auth/vkontakte.js), we encounter the following error:
"Parse error: Vk appIds or appSecret is incorrect."
stack trace:
"Error: Vk appIds or appSecret is incorrect.at /app/node_modules/parse-server/lib/Adapters/Auth/vkontakte.js:20:11
at runMicrotasks ()
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at async Promise.all (index 0)"
We have noticed that the vkontakte.js file has not been updated since 2020. We have verified multiple times that our appId and secret are correct and unchanged.
After contacting VK support, they noted an API change as of Oct 2022. See their response:
Reply - "Since October 17, 2022, we have disabled the ability to obtain a service token through the Client Credentials Flow: https://dev.vk.com/reference/roadmap#Disabling_Clien... If you are working with methods in the secure section, you need to use the service key from the application settings."
Steps to reproduce
Any login via vkontakte results in this error
When performing the request manually via curl (following current vkontakte.js current implementation), we receive an error:
curl -X POST 'https://oauth.vk.com/access_token'
-d 'grant_type=client_credentials'
-d 'client_id=0000000'
-d 'client_secret=XXXXXXXXXXXXXXXXXXXX'
-d 'v=5.124'
{"error":"invalid_grant","error_description":"Access denied"}
Actual Outcome
See above stack trace and error
Server
- Parse Server version: 4.10.4 ( we think? most recent vkontakte Adapter is present.)
- Operating system: `Linux
- Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): AWS
Database
- System (MongoDB or Postgres): PSQL
- Database version:
- Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): AWS
Client
- SDK (iOS, Android, JavaScript, PHP, Unity, etc): Any client
- SDK version:
Logs
{"code":101,"level":"error","message":"Parse error: Vk appIds or appSecret is incorrect.","stack":"Error: Vk appIds or appSecret is incorrect.\n at /app/node_modules/parse-server/lib/Adapters/Auth/vkontakte.js:20:11\n at runMicrotasks ()\n at processTicksAndRejections (node:internal/process/task_queues:96:5)\n at async Promise.all (index 0)"}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with parse-server/lib/Adapters/Auth/vkontakte.js and reproduce the documented curl request against VK's OAuth endpoint. Compare the adapter's client-credentials flow with VK's October 2022 API change; done means Vkontakte login succeeds without the invalid_grant or incorrect app credentials error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100