POST using CURL in PHP gives an invalid request Error

Question

I am using the post method below for google account using curl, but it gives me invalid_request error.

POST /o/oauth2/token HTTP/1.1 Host: accounts.google.com Content-Type: application/x-www-form-urlencoded code=4/ux5gNj-_mIu4DOD_gNZdjX9EtOFf& client_id=1084945748469-eg34imk572gdhu83gj5p0an9fut6urp5.apps.googleusercontent.com& client_secret=CENSORED& redirect_uri=http://localhost/oauth2callback& grant_type=authorization_code 

Here is my php code with curl

 $text ='test'; $URL = "https://accounts.google.com/o/oauth2/token"; $header = array( "POST /o/oauth2/token HTTP/1.1", "Host: accounts.google.com", "Content-type: application/atom+xml;charset=\"utf-8\"", "Accept: text/xml", "Cache-Control: no-cache", "code=[my_code]&client_id=[my_client_id]&client_secret=[my_client_secret]& redirect_uri=http://localhost/curl_resp.php&grant_type=authorization_code", "Content-length: ".strlen($text), ); $xml_do = curl_init(); curl_setopt($xml_do, CURLOPT_URL, $URL); curl_setopt($xml_do, CURLOPT_CONNECTTIMEOUT, 10); curl_setopt($xml_do, CURLOPT_TIMEOUT, 10); curl_setopt($xml_do, CURLOPT_RETURNTRANSFER, true); curl_setopt($xml_do, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($xml_do, CURLOPT_SSL_VERIFYHOST, false); curl_setopt($xml_do, CURLOPT_POST, false); curl_setopt($xml_do, CURLOPT_POSTFIELDS, $text); curl_setopt($xml_do, CURLOPT_HTTPHEADER, $header); 

And I have an invalid request error

Answer 1

I don’t know anything about using the Google OAuth API, but from the examples I’ve examined so far, it looks like you should pass values ​​(i.e. code , client_id , etc.) in the message fields and not directly in the HTTP header.

The following example still does not work fully, but instead of receiving an invalid_request error, it gives you invalid_grant . I think in addition to what I mentioned (maybe you need new credentials from Google or something else), but this can take you one step closer, at least:

 $post = array( "grant_type" => "authorization_code", "code" => "your_code", "client_id" => "your_client_id", "client_secret" => "your_client_secret", "redirect_uri" => "http://localhost/curl_resp.php" ); $postText = http_build_query($post); $url = "https://accounts.google.com/o/oauth2/token"; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postText); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); $result = curl_exec($ch); var_dump($result); // gets an error, "invalid_grant" 

Answer 2

The answer to your request actually includes a very readable description of the problem:

POST requests require a Content-length header.

Answer 3

Why is your CURLOPT_POST set to false ?

  curl_setopt($xml_do, CURLOPT_POST, false); 

Although some cURL configurations will automatically change this to tru, if CURLOPT_POSTFIELDS is set, you do not have a valid postfield.

Full details for publishing in "POST" HTTP mode. To publish the file, add the file name with @ and use the full path. A file type can be explicitly specified by following a file name with a type in the format '; type = mimetype '. This parameter can be passed as a string with urlencoded, such as "para1 = val1 & para2 = val2 & ..." or as an array with the field name as the key and field data as the value. If the value is an array, the Content-Type header will be set to multipart / form-data. Starting with PHP 5.2.0, the value must be an array if files are passed to this parameter with the @ prefix.

It should be either in param = value syntax or in an array.

Answer 4

I used the post array in the CURL method and valid google code, and it worked for me

Answer 5

I also had the same issue when google returns "invalid_xxx".

After much research and troubleshooting, the problem is coding the form itself! Do not use the "http_builder_query" function because it loads a string and Google cannot recognize it. Example:

http_builder_query Exit: "code = 4% 252FYYUT71KJ6 ..."

compared with

just a normal line: "code = 4 / YYUT71KJ6 ..."

Here is my working code where I placed the "x" in the places where your own data is needed (taken and modified with Google Oauth authentication )

  $code_from_user_login = "4/YYUT71KJ6...."; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "https://accounts.google.com/o/oauth2/token"); curl_setopt($ch, CURLOPT_POST, TRUE); curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); $post_params = "code=" . $code_from_user_login . "&"; $post_params .= "redirect_uri=http://www.x.com/&"; $post_params .= "client_id=x.apps.googleusercontent.com&"; $post_params .= "client_secret=x&"; $post_params .= "grant_type=authorization_code&"; curl_setopt($ch, CURLOPT_POSTFIELDS, $post_params); $result = curl_exec($ch); print($result); 

The result will look like this:

  '{ "access_token" : "ya29.AHES6ZSwJSHpTZ1t....", "token_type" : "Bearer", "expires_in" : 3599, "id_token" : "eyJhbGciOiJSUzI1NiIsImtpZCI6IjU0MDQxOTZlMmQzOGNjYTA2MW...." }' 

Once you have "access_token", access your profile data using this URL: https://www.googleapis.com/oauth2/v1/userinfo?access_token=YOUR_ACCESS_TOKEN_HERE

~ end ~