mwoauth-callback-not-oob-or-prefix error when trying to log into quickstatements

[Johannes Hentschel]

I basically get the same error as BDavis (WMF) reported here two months ago.

We are running the quickstatements docker image and have configured it with Oauth key and secret. The tool is running on its own subdomain https://mwquick.epfl.ch/ The error occurs when clicking on “Log in” and looks like this:

<br />
<b>Fatal error</b>:  Uncaught Exception: Error retrieving token1: {&amp;quot;error&amp;quot;:&amp;quot;mwoauth-callback-not-oob-or-prefix&amp;quot;,&amp;quot;message&amp;quot;:&amp;quot;oauth_callback must be set, and must be set to \&amp;quot;oob\&amp;quot; (case-sensitive), or the configured callback must be a prefix of the supplied callback.&amp;quot;,&amp;quot;callback&amp;quot;:&amp;quot;api.php&amp;quot;} in /var/www/html/magnustools/public_html/php/oauth.php:284
Stack trace:
#0 /var/www/html/quickstatements/public_html/api.php(89): MW_OAuth-&gt;doAuthorizationRedirect('api.php')
#1 {main}
  thrown in <b>/var/www/html/magnustools/public_html/php/oauth.php</b> on line <b>284</b><br />

The current config looks like this (Kubernetes format):

# Unclear whether to use WIKIBASE_HOST <-- https://github.com/wmde/wikibase-docker/blob/master/quickstatements/README.md)
#   or rather WIKIBASE_SCHEME_AND_HOST <-- https://github.com/wmde/wikibase-docker/blob/master/docker-compose.yml)
        - name: WIKIBASE_SCHEME_AND_HOST
          value: "wikibase-svc"
        - name: QS_PUBLIC_SCHEME_HOST_AND_PORT
          value: "https://mwquick.epfl.ch"
        - name: WB_PUBLIC_SCHEME_HOST_AND_PORT
          value: "https://muwi.epfl.ch"
        - name: WB_PROPERTY_NAMESPACE
          value: "122"
        - name: WB_PROPERTY_PREFIX
          value: "Property:"
        - name: WB_ITEM_NAMESPACE
          value: "120"
        - name: WB_ITEM_PREFIX
          value: "Item:"
        - name: OAUTH_CONSUMER_KEY
          value: [KEY]
        - name: OAUTH_CONSUMER_SECRET
          value: [SECRET]

The Oauth consumer has been set up as explained here. The callback URL is https://mwquick.epfl.ch/api.php.

[Johannes Hentschel]

Hi there, once more I tried to fix the error by myself but did not get any further. Here I post the error message once more but decoded for better readability:

{"error":"mwoauth-callback-not-oob-or-prefix","message":"oauth_callback must be set, and must be set to \"oob\" (case-sensitive), or the configured callback must be a prefix of the supplied callback.","callback":"api.php"} in /var/www/html/magnustools/public_html/php/oauth.php:284

It looks as if this could easily be fixed if someone would be so kind as to tell me where and how I need to set the configured callback.

‌

I’ve looked at the code used to construct the query that causes the error, this is /var/www/html/magnustools/public_html/php/oauth.php:246

$url = $this->mwOAuthUrl . '/initiate';
$query = [
    ...
    // OAuth information
    'oauth_callback' => 'oob', // Must be "oob" for MWOAuth
    ...
] ;
if ( $callback!='' ) $query['oauth_callback'] = $callback ;

Since $callback = ‘api.php’, it will overwrite the value “oob” for ‘oauth_callback’, leaving me only with the choice to somehow get this configuration right. As stated before, the consumer’s callback is configered as https://mwquick.epfl.ch/api.php so this cannot be the problem, right?

[Dan Michael O. Heggø]

Here’s a proposed fix: https://github.com/magnusmanske/quickstatements/pull/1

Per https://github.com/magnusmanske/quickstatements/commit/e1f0a86b85bde4942197377e2617e04cf1c376a6 , it seems like the latest version of the quickstatements repo is now on GitHub, not on Diffusion, so we also need to update the Docker image to use the new repo: https://github.com/wmde/wikibase-docker/pull/131