VK Oauth: security bug

Question

I am trying to authorize my standalone application. But after I click "Allow", it always redirects to http://oauth.vk.com/error?err=2 and gives it as the response body:

 {"error":"invalid_request", "error_description":"Security Error"} 

Here's the url of the request (I have the correct client_id ):

 https://oauth.vk.com/authorize?client_id=...&scope=messages,offline&redirect_uri=https://oauth.vk.com/blank.html&display=page&v=5.37&response_type=token 

It seems like I tried everything:

• Turn on and off the application
• Passing the scope as a bitmask
• URI encoding some parameters to have the correct URL
• etc.

Answer 1

After an hour of searching, I found this .

So this means that the user has an old session and must re-enter the browser.