Account Linking with my own OAuth server in Actions on Google missing grant type

Question

I'm trying to implement a smarthome action. It started with this example
https://codelabs.developers.google.com/codelabs/smarthome-washer/#0
And this was working.

This example uses firestore as the cloud service.
I want to implement the server by myself. For the first test as a server on my local PC which is reachable with port forwarding.
I created a let's encrypt certificate and uses a nodejs express htpps server.
For the Oauth implementation I uses the same "unsecure" code as the example.

    expressApp.get('/fakeauth', async (req, res) => {
        console.log('fakeauth',req.headers, req.body, req.query);
        const responseurl = util.format('%s?code=%s&state=%s',
          decodeURIComponent(req.query.redirect_uri), 'xxxxxx',
          req.query.state);
        console.log(responseurl);
        return res.redirect(responseurl);
    });

    expressApp.all('/faketoken', async (req, res) => {
        console.log('faketoken',req.headers, req.body, req.query);
        const grantType = req.query.grant_type
          ? req.query.grant_type : req.body.grant_type;
        const secondsInDay = 86400; // 60 * 60 * 24
        const HTTP_STATUS_OK = 200;
        console.log(`Grant type ${grantType}`);

        let obj;
        if (grantType === 'authorization_code') {
          obj = {
            token_type: 'bearer',
            access_token: '123access',
            refresh_token: '123refresh',
            expires_in: secondsInDay,
          };
        } else if (grantType === 'refresh_token') {
          obj = {
            token_type: 'bearer',
            access_token: '123access',
            expires_in: secondsInDay,
          };
      }
        res.status(HTTP_STATUS_OK)
          .json(obj);
    });

Now I changed the account linking urls to my local server. When I try to connect to this Action it isn't working.

The request to the fakeauth endpoint is ok.
But when google calls the faketoken endpoint the queries are missing and the body is empty.
The requested url is .../faketoken without any query and an empty body.

It couldn't be a problem with the response of the fakeauth request because if I send the fakeauth request to my server and the faketoken request to the firestore server the account linking is working.
The second I tried.
Send the fakeauth to the firestore server and the faketoken to my server.
The result is the same. No Query and no body.

I don't know what I'm doing wrong because it's the request from google which is wrong.

Does anybody has an idea what's wrong. I have searched but I couldn't found someone who has the same problem.

Thanks for your help.
Regards Simon

Answer 1

You can use the Google OAuth Playground to verify that your account linking implementation is working properly. Here is how you can configure this tool to test your custom endpoint:

1. Open the Settings gear, change OAuth endpoints to Custom
2. Enter your authorization and token URLs from the Actions console
3. Enter your client ID and secret from the Actions console

You won't be authorizing any Google APIs, so for Step 1 you can just enter something like "devices" and click Authorize APIs . You can follow through with the flow in Step 2 to verify that the authorization and token exchange work properly. The tool will report if any errors occur in the flow.

Answer 2

To help others I will describe the problem.

I thought that the data are send as url query because the code reads them from the query object.

But they are send in the body with content-type: application/x-www-form-urlencoded

If I use

expressApp.use(bodyParser.urlencoded());

The data are added to the queries and the original testcode is working.