[英]405 method not allowed error in AWS Cognito oauth2/token endpoint
I'm using AWS Cognito UI for login using authorization code grant flow and successfully getting the authorization code.我正在使用 AWS Cognito UI 使用授权代码授予流程进行登录并成功获取授权代码。 But getting an 405 method not allowed error when post request is made to oauth2/token endpoint via postman但是当通过邮递员向 oauth2/token 端点发出发布请求时,出现405 方法不允许错误
The app client is setup in Cognito User Pool with app secret passing appclientid:appclientsecret as authorization in base64 encoding.应用程序客户端在 Cognito 用户池中设置,应用程序密码通过 appclientid:appclientsecret 作为 base64 编码的授权。
As stated in the documentation:如文档中所述:
Content-Type Must always be 'application/x-www-form-urlencoded'. Content-Type 必须始终为“application/x-www-form-urlencoded”。
Source: https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html来源: https ://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html
Use BasicAuth of Authentication and provide Username
= client_id
, Password
= client_secret
使用 Authentication 的 BasicAuth 并提供Username
= client_id
, Password
= client_secret
Use POST
method使用POST
方法
Use Body
= x-www-form-urlencoded
使用Body
= x-www-form-urlencoded
Dont forget to use State
value in Body as well.不要忘记在 Body 中也使用State
值。
I had a similar problem.我有一个类似的问题。 In my case I had to change the Accept header to */*
.在我的例子中,我不得不将 Accept 标头更改为*/*
。
When I had it as Accept=text/html,application/xhtml+xml,application/xml
it responded with 405 to the /token endpoint.当我将它作为Accept=text/html,application/xhtml+xml,application/xml
时,它以 405 响应到 /token 端点。 Hopefully that helps somebody.希望这对某人有帮助。
I was writing code in c# for token with authorization_code grant type and all calls were failing with 405 Method Not Allowed status.我在 c# 中为具有 authorization_code 授权类型的令牌编写代码,所有调用都失败,状态为405 Method Not Allowed 。
According to AWS documentation following URL and parameters should be used根据 AWS 文档,应使用以下 URL 和参数
POST https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/token&
Content-Type='application/x-www-form-urlencoded'&
Authorization=Basic aSdxd892iujendek328uedj
grant_type=authorization_code&
client_id=djc98u3jiedmi283eu928&
code=AUTHORIZATION_CODE&
redirect_uri=com.myclientapp://myclient/redirect
After spending 2 hours, I found out, removing & from URL would solve the issue, so make sure your request looks like this花了 2 小时后,我发现从 URL 中删除&可以解决问题,因此请确保您的请求看起来像这样
POST https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/token
Content-Type='application/x-www-form-urlencoded'
Authorization=Basic aSdxd892iujendek328uedj
grant_type=authorization_code&
client_id=djc98u3jiedmi283eu928&
code=AUTHORIZATION_CODE&
redirect_uri=com.myclientapp://myclient/redirect
Well, just in case it helps anybody.好吧,以防万一它可以帮助任何人。
I was facing a 405 in Postman while trying to retrieve the respective jwt tokens (id_token, access_token, refresh_token) using the grant_type as authorization_code.在尝试使用 grant_type 作为 authorization_code 检索相应的 jwt 令牌(id_token、access_token、refresh_token)时,我在 Postman 中遇到了 405。
reason being the headers section where I was using 'application/x-www-form-urlencoded'
as value for Content-Type
ie with single quotes.原因是标题部分,我在其中使用'application/x-www-form-urlencoded'
作为Content-Type
的值,即带有单引号。 So, when I removed these single quotes and only used application/x-www-form-urlencoded
right away, it started working.因此,当我删除这些单引号并立即只使用application/x-www-form-urlencoded
时,它开始工作了。
I resolved this error 405 method not allowed error in AWS Cognito oauth2/token
endpoint by making my code as below mentioned, and it worked fine.我通过编写下面提到的代码解决了 AWS Cognito oauth2/token
端点中的错误 405 方法不允许错误,并且它工作正常。 I took help from this link and use the correct format to mention both header and body parameters in the fetch request:我从此链接获得帮助,并使用正确的格式在获取请求中提及标头和正文参数:
https://formcarry.com/documentation/fetch-api-example https://formcarry.com/documentation/fetch-api-example
const requestOptions = {
method: "POST",
headers: {
"Content-Type": "application/x-www-form-urlencoded",
"Authorization": `Basic ${authData}`,
"Accept": "application/json"
},
body: `grant_type=${config.grant_type}&code=${code}&client_id=${config.clientId}&redirect_uri=${config.loginRedirectUri}`
}
fetch(`${config.domainUrl}/oauth2/token`, requestOptions)
.then(response => response.json())
.then(data => {
sessionStorage.setItem("access_token",data.access_token)
fetchUserDetails(data.access_token)
})
I used a config file to save variables.我使用配置文件来保存变量。
const config = {
domainUrl: "https://domainname.auth.origin.amazoncognito.com",
clientId: "xxxxxxxxxxxx",
loginRedirectUri: "http://localhost:8000/redirecturi",
grant_type: "authorization_code",
logoutUri: "http://localhost:8000",
clientSecret: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
I had the same issue, although using client_credentials rather than authorization_code.我遇到了同样的问题,尽管使用的是 client_credentials 而不是 authorization_code。
In Postman I was using basic auth with a valid client_id
/ client_secret
as username/password, made sure the Content-Type: application/x-www-form-urlencoded
header was there, and set the body ( raw/json
) to:在 Postman 中,我使用基本身份验证和有效的client_id
/ client_secret
作为用户名/密码,确保 Content-Type: application/x-www-form-urlencoded
标头在那里,并将正文( raw/json
)设置为:
{
"client_id": {client_id},
"grant_type": "client_credentials",
"scope": {client_scope}
}
However, I was still getting the 405: Method Not Allowed
error.但是,我仍然收到405: Method Not Allowed
错误。 I eventually figured out that I could switch the body type to x-www-form-urlencoded
in Postman, re-entered the body parameters and now it's working.我最终发现我可以在 Postman 中将正文类型切换为x-www-form-urlencoded
,重新输入正文参数,现在它可以正常工作了。
var strClientSecret = $"{"your_clientId"}:{"your_clientsecret"}";
var client = new HttpClient();
var body = new Dictionary<string, string>();
body.Add("grant_type", "client_credentials");
body.Add("client_id", "your_appclientid");
body.Add("redirect_uri", "your_callbackurl");
var content = new FormUrlEncodedContent(body);
var autho = System.Text.Encoding.UTF8.GetBytes(strClientSecret);
var base64Autho = System.Convert.ToBase64String(autho);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", base64Autho);
client.DefaultRequestHeaders.TryAddWithoutValidation("Content-Type", "application/x-www-form-urlencoded");
var response = await client.PostAsync("https://your_domain.auth.ap-south-1.amazoncognito.com/oauth2/token", content);
And to make the picture complete, if your Host header is not set or not the same as the domain that you are posting to, you will also get a 405 (Method not allowed).为了使图片完整,如果您的主机标头未设置或与您要发布到的域不同,您还会收到 405(方法不允许)。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.