"You do not have permission" at "api/users/me" and Fatal error: Call to undefined method

[suj87]

When my OAuth flow points to api/users/me with Bearer token added to authorization header - I'm receiving the error You do not have permission.

If I manually add oauth_token=token as query string parameter (for testing), the request seems to work but receive the error: Fatal error: Call to undefined method Xfrocks\Api\XF\ApiOnly\Template\Templater::func() in \htdocs\xf2.1\src\addons\Xfrocks\Api\XF\Transform\User.php on line 160

Any ideas?

Test setup is: WAMP 2.4 (Apache 2.4.4, PHP 5.6.40). XF version 2.1.1. BDAPI version 2.0.1 Beta 4.

[daohoangson]

That's weird... Are you still having this problem today?

[suj87]

That's weird... Are you still having this problem today?

Yes unfortunately. I've been waiting for your reply as I don't know where to start with debugging, haha. I tried uninstalling and reinstalling the add-on a couple of times but same issue. (This is on a completely fresh install of XF).

The exact same code I use against XF 1.5 and BDApi works perfectly.

Are you able to reproduce the issue?

[daohoangson]

Oh, you were running XenForo 2.1.1 not 2.1.10... Yes, that's expected. You have to update to at least 2.1.4 for this.

[suj87]

Upgrading to 2.1.4 correctly shows user info if oauth_token is passed in URL - so thanks for that :)

However, if oauth token is added to authorization header, the same 403 Forbidden error occurs e.g.:

RequestMessage	{Method: GET, RequestUri: 'http://192.168.0.20:81/xf2.1/bdapi/users/me', Version: 1.1, Content: <null>, Headers:
{
  Accept: application/json
  Authorization: Bearer 7mRfcYc2PwEpci2fjCpPFz6q5jh6HA31puV2ANcD
  User-Agent: Microsoft
  User-Agent: ASP.NET
  User-Agent: Core
  User-Agent: OAuth
  User-Agent: handler
  Request-Id: |6797f6c7-458833252b1cc5b2.
}}

Does this version not support grabbing token from headers?

Thanks

[suj87]

Ahh, this is due to Apache stripping headers for some reason, as mentioned here: #60 (comment)

[daohoangson]

Ah, Apache. I recall hearing about something similar but couldn't find that issue. Glad you sorted it out.