The redirect URI piece of oauth2 when using client-side authentication for YouTube API browser-based has extra fields in it

Question

I am trying to setup an automatic way to upload videos to YouTube using the YouTube API. The application needs the videos to be uploaded for some processing by YouTube. Currently, I am setting up the oauth2.0 piece and I am able to redirect the user to login with their information. However, when the user is then redirected back to my site with my specified redirect uri, I need to be able to accept custom fields on the end of the URL. Right now, the web server just redirects the user to the page I want, but strips off all of the information returned by YouTube about authentication. I do not know much PHP at all, but think that it might be the way to solve this problem. Essentially, I want to be able to redirect the user to a page on the website where the extra information is retained so that I can use it. Thanks for your help.

http://ocf.berkeley.edu/~gregory/youtubeTestCode/indexRedirect#access_token=ya29.AHES6ZS8kOZN2T59fKpoUE0t7roUXqTPWDAwTMvrhZ5TjlZO57JZNQ&token_type=Bearer&expires_in=3600

The format of the redirect is http://ocf.berkeley.edu/~gregory/youtubeTestCode/indexRedirect followed by #access_token=ya9232.jdfka7327293&token_type=Bearer&expires_in=3600

However, I have no page with this specific URL..

So are you saying the URL used for the return is being rewritten to exclude the query string which is sent from YouTube? — Mike Brant
I guess so - the place I am hosting my website on thinks the URL requested was mistyped and so it strips off the end part and sends the user to the page that it is in the site. The YouTube API gives back something like ocf.berkeley.edu/~gregory/youtubeTestCode/…, but the user is redirected to everything before the '#' character — user1201163
Can you add samples of the URL provided from YouTube and what it is re-written to in the question? THe formatting seemed to break in your comment. How control do you have over the server that this is being hosted on? Do you have an .htaccess file (if using Apache) that might effect this behavior? — Mike Brant
I do not have an .htaccess file, but possibly I could add one? It is hosted on a school server — user1201163

Robbie Robbie · Accepted Answer · 2012-08-29T21:26:30

There are two authentication methods for YouTube - client-side and server-side. (Actually there are more, but I've never used the others).

Documentation is https://developers.google.com/youtube/2.0/developers_guide_protocol_oauth2 but I'l try to paraphrase the bits you need.

"client-side" is what you are using - you basically send the user over the a URL and let google do the work and get the access token back.

"server-side" is what you'll need (as you guessed). To convert, as opposed to sending the user off to a url that ends "&response_type=token", change this bit to "&response_type=code& access_type=offline"

When you get the call back, you have ?code=4/ux5gNj-_mIu4DOD_gNZdjX9EtOFf - hopefully you can read this as it's before the #

You then use a POST to send this code to the Google servers and it sends back the token in JSON. Taken from that page before:

POST /o/oauth2/token HTTP/1.1
Host: accounts.google.com
Content-Type: application/x-www-form-urlencoded

code=4/ux5gNj-_mIu4DOD_gNZdjX9EtOFf&
client_id=1084945748469-eg34imk572gdhu83gj5p0an9fut6urp5.apps.googleusercontent.com&
client_secret=hDBmMRhz7eJRsM9Z2q1oFBSe&
redirect_uri=http://localhost/oauth2callback&
grant_type=authorization_code

and response is:

{
  "access_token" : "ya29.AHES6ZTtm7SuokEB-RGtbBty9IIlNiP9-eNMMQKtXdMP3sfjL1Fc",
  "token_type" : "Bearer",
  "expires_in" : 3600,
  "refresh_token" : "1/HKSmLFXzqP0leUihZp2xUt3-5wkU7Gmu2Os_eBnzw74"
}

So "relatively" simply change, but you need the PHP part to do the POST as it requires your secret key (which you don't want to reveal through Javascript).

I'll leave you to Google on how to:

read parameters in PHP (hint - use $_GET['paramter name'])
send a POST message to Google using CURL.

An alternative is to check out YouTube SDK for PHP - these are pre-written libraries that contain the POST and the GET bits for you. But this uses something called "Zend" which can get complex. https://developers.google.com/youtube/2.0/developers_guide_php

The redirect URI piece of oauth2 when using client-side authentication for YouTube API browser-based has extra fields in it

1 Answers