google-apigoogle-openidgoogle-identitygoogle-signin

Google Sign-In for server-side apps: exchange of a valid authorization code to a token - Bad Request Error (Error: redirect_uri_mismatch)


I'm trying to implement Google Sign-In (https://developers.google.com/identity/sign-in/web/server-side-flow) for my application. I've managed to successfully get an authorisation code, but when I try to exchange it to a token, I get the following response.

Error Response:

{
    "error": "redirect_uri_mismatch",
    "error_description": "Bad Request"
}

I have already tried adding a number of redirect URLs to the google console but this issue still persists. Please refer to redirect URLs below.

http://localhost:49188/oauthcallback.aspx
https://localhost:49188/oauthcallback.aspx
https://localhost:49188/oauthcallback.aspx
http://localhost/oauthcallback.aspx
https://localhost/oauthcallback.aspx
http://localhost/oauthcallback.aspx
https://localhost/oauthcallback.aspx

I've tried multiple requests using different token endpoints, but it doesn't resolve this issue.

1st endpoint:

POST URI: www.googleapis.com/oauth2/v4/token 
Content-Type: application/x-www-form-urlencoded

code={code}&
client_id={xxx}.apps.googleusercontent.com&
client_secret={client_secret}&
redirect_uri=https://localhost:49188/oauthcallback.aspx&
grant_type=authorization_code

2nd endpoint:

POST URI: https://oauth2.googleapis.com/token
Content-Type: application/x-www-form-urlencoded

code={code}&
client_id={xxx}.apps.googleusercontent.com&
client_secret={client_secret}&
redirect_uri=https://localhost:49188/oauthcallback.aspx&
grant_type=authorization_code

I expect to get the proper token response but refer to below JSON as it is the response that I get.

Expected Response:

{
  "access_token":"1/fFAGRNJru1FTz70BzhT3Zg",
  "expires_in":3920,
  "token_type":"Bearer",
  "refresh_token":"1/xEoDL4iW3cxlI7yDbSRFYNG01kVKM2C-259HOF2aQbI"
}

Error Response

{
    "error": "redirect_uri_mismatch",
    "error_description": "Bad Request"
}

Solution

  • @user2705223 You have highlighted a good point. So, if you use ux_mode="popup" or default, It seems the JS SDK adds the domain host as the default redirect URL instead of the URL specified when initialising, which is pretty weird.