Change C# Owin response type from code to token

Question

I am trying to use OWIN for external login into Google/Facebook.

The issue faced is the owin challenge keeps changing the response type from token to code.

The challenge generates the following URL: https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=client_dim&redirect_uri=mywebsite.com&scope=scope&state=state

This returns an error from google. If I change the response_type to token (response_type=token) it works.

Here is the OAuth Options

 OAuthOptions = new OAuthAuthorizationServerOptions
        {

            TokenEndpointPath = new PathString("/Token"),
            Provider = new ApplicationOAuthProvider(PublicClientId),
            AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),

            // In production mode set AllowInsecureHttp = false
            AllowInsecureHttp = true,


        };

Google Middleware setup:

 app.UseGoogleAuthentication(new GoogleOAuth2AuthenticationOptions()
        {
            ClientId = "clientid",
            ClientSecret = "client secret",  
        });

Here is the challenge:

   var properties = new AuthenticationProperties() {   AllowRefresh = true, RedirectUri="mywebsite.co.za"  };


        Request.GetOwinContext().Authentication.Challenge(properties,LoginProvider);

        HttpResponseMessage response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
        response.RequestMessage = Request;
        return Task.FromResult(response);

The OWIN is a basic setup from the generic MVC API project.

TommyBoii TommyBoii · Accepted Answer · 2016-12-28T12:41:59

The solution to rewriting the response_type to token is the following:

 GoogleOAuth2AuthenticationOptions googleOAuth2AuthenticationOptions = new GoogleOAuth2AuthenticationOptions
        {
            ClientId = "clientid",
            ClientSecret = "secret",

            Provider = new GoogleOAuth2AuthenticationProvider
            {
                OnApplyRedirect = context =>
                {
                    string redirect = context.RedirectUri.Replace("response_type=code", "response_type=token");
                    context.Response.Redirect(redirect);
                },

            },
        };

        app.UseGoogleAuthentication(googleOAuth2AuthenticationOptions);

It still begs the question, if the google OAuth 2.0 requires response_type=token why does the Owin.google provider use response_type=code.

Change C# Owin response type from code to token

1 Answers