Rclone and Box insecure_redirect_uri

Hello,

I work at Indiana University Research Technologies in the Research Applications and Deep Learning Group. We manage a service called Research Desktop. One of the services we had been providing was a mount of a user's IU Box directory within Research Desktop.

We were doing this using rclone.
Recently configuring new remote connections to IU Box stopped working.

When rclone attempts to authorize a connection, an error occurs in the web page that says: "There seems to be a problem with this app." It then goes to the following (or similar) address:

https://app.box.com/api/oauth2/authorize?access_type=offline&client_id=d0374ba6pgmaguie02ge15sv1mllndho&redirect_uri=http%3A%2F%2F127.0.0.1%3A53682%2F&response_type=code&state=MgvB0SEYqvuu_gc3hfL6dQ

The detail of the error is:

----------------------------------------------
IError: insecure_redirect_uri

Show Error Details

    response_type=code
redirect_uri=http://127.0.0.1:53682/
state=MgvB0SEYqvuu_gc3hfL6dQ
client_id=d0374ba6pgmaguie02ge15sv1mllndho
----------------------------------------------

I have downloaded the most recent version of rclone (v 1.51.0) but it also has the error.

It occurs when the following command is used to configure the box remote:

$ rclone --log-level DEBUG config create Box box
2020/02/27 12:13:59 DEBUG : rclone: Version "v1.51.0" starting with parameters ["rclone" "--log-level" "DEBUG" "config" "create" "Box" "box"]
2020/02/27 12:13:59 NOTICE: Config file "/N/u/hbrokaw/Carbonate/.config/rclone/rclone.conf" not found - using defaults**
Remote config
Use auto config?
 Say Y if not sure
 Say N if you are working on a remote or headless machine
Auto confirm is set: answering Yes, override by setting config parameter config_is_local=false
2020/02/27 12:13:59 DEBUG : Starting auth server on 127.0.0.1:53682
If your browser doesn't open automatically go to the following link: http://127.0.0.1:53682/auth?state=MgvB0SEYqvuu_gc3hfL6dQ
Log in and authorize rclone for access
Waiting for code...

The Web Browser then opens to the error I mentioned above.
Thanks for any information you can provide that may be helpful in fixing this problem.

Sincerely,
Cicada Dennis

Indiana University
Research Technologies
Research Applications and Deep Learning

Check a post or two down:

I finally saw it. Thank you for your help!.

I have recieved information that Box is working with rclone to resolve this issue (names removed from the email for retention of privacy):

Feb 27, 4:36 PM PST
...

Thanks so much for contacting Box Product Support!

We are currently working with Rclone to resolve this issue to help fix this issue their end. We will let you know as soon as we receive word it's resolved.

...
[name of person removed] - Box Certified Professional
Technical Support Engineer
Specialization: Platform, API and Integrations

Additional Resources: https://community.box.com/

The box team have unlisted rclone from the app gallery.

This should mean that

  • the 127.0.0.1 redirect works OK
  • the old config works OK.

I had no idea getting rclone listed in the app gallery would cause so much disruption - I'll try to work with box for a smoother transition next time.

I was receiving the same 'insecure_redirect_uri' error. As of yesterday, coinciding with ncw's update, I am now getting a different error. When I run rclone config, and get to the browser authorization step, a page opens on box.com with this error:
Storage> 6
** See help for box backend at: https://rclone.org/box/ **

Box App Client Id.
Leave blank normally.
Enter a string value. Press Enter for the default ("").
client_id> 
Box App Client Secret
Leave blank normally.
Enter a string value. Press Enter for the default ("").
client_secret> 
Box App config.json location
Leave blank normally.
Enter a string value. Press Enter for the default ("").
box_config_file> 

Enter a string value. Press Enter for the default ("user").
Choose a number from below, or type in your own value
 1 / Rclone should act on behalf of a user
   \ "user"
 2 / Rclone should act on behalf of a service account
   \ "enterprise"
box_sub_type> 2
Edit advanced config? (y/n)
y) Yes
n) No (default)
y/n> n
Remote config
Use auto config?
 * Say Y if not sure
 * Say N if you are working on a remote or headless machine
y) Yes (default)
n) No
y/n> y
If your browser doesn't open automatically go to the following link: http://127.0.0.1:53682/auth?state=*****************
Log in and authorize rclone for access
Waiting for code...


Error: redirect_uri_mismatch
    response_type=code
    redirect_uri=http://127.0.0.1:53682/
    state=***************************
    client_id=*************************

This occurs on all versions of rclone I have tried (1.47.0, 1.50.2, 1.51.0). This is for an enterprise account.

On the page with the error, if I edit the url to change the redirect_uri parameter to redirect_uri=https%3A%2F%2F127.0.0.1%3A53682, the process proceeds to an SSO log in. After logging in, I get the 'Grant access to box' button. When I click that, it redirects to a 127.0.0.1 url with the following error:

Thank you for helping to resolve this issue and for any assistance you can give.

@shuysman - that SSL error is because it is trying to go back to 127.0.0.1 as HTTPS, not HTTP.
If you remove the S and press return in your browser, it works.
However when i did this, I got the following in rclone:

Got code 2020/03/03 16:31:41 Failed to configure token with oauth authentication: failed to get token: oauth2: cannot fetch token: 400 Bad Request Response: {"error":"redirect_uri_mismatch","error_description":"The redirect URI is missing or do not match"}

I tried as @Chewie9999 suggested and got the same error

It looks like the redirect_uri in the app config was changed to https://127.0.0.1 I don't know wny. I've changed it back to http://127.0.0.1 and hopefully it will work now.

Sorry about that - I don't know why that happened.

This morning I recieved word from Box support that the issue has been resolved. I have tested my installation, and it is working again.

1 Like

I tested on two of my machines and I was able to configure box as a remote and connect as normal again. Thanks, all

1 Like

This topic was automatically closed after 59 days. New replies are no longer allowed.