403 forbidden from token endpoint

Questions OAuth/OIDC
1

Hello I am trying to access the token endpoint from my javascript Cordova application and I am getting the 403 Forbidden error. I have verified that the client_id and other parameters are accurate by running the same scenario through Postman, but when I run the same request from my application I get the 403 error.

I can get the authorization_code in the app as well as receive the access_token and id_token if I call the authorization endpoint with id_token and token, however when I try the PKCE route I am running into that 403 Forbidden error.

I have had the issue with PKCE from a “Native” app. I have also tried a “Web” app but have gotten the same results. All seems to work through Postman but then I get the 403 Forbidden error in the app.

2

Are you using Ionic + Cordova or just JavaScript? The reason I ask is because I’ve successfully used Ionic AppAuth to integrate authentication with Okta.

3

I don’t intend to use Ionic, it is just a JavaScript app.

4

I’ll admit. I haven’t tried to use our APIs with raw JavaScript. I tend to use a library, like AppAuth-JS.

5

Okay, I can look into that library. Just seems a bit strange that Postman will connect through fine while using the “code” from Postman does not.

6

Hi @whodeee

Can you please check https://github.com/dragosgaftoneanu/okta-js-scripts/blob/master/auth-code-flow-pkce-spa/index.html? This sample does authorization code flow with PKCE in native JavaScript and gets the JWTs from Okta.

7

Thanks @dragos, I’ll check it out and let you know.

8

@dragos and @mraible I was able to solve my issue! I had to add “file://” to my Trusted Origin as well as adding it as a Redirect_URI for my app, then all worked well. Any issues you see using that?

9

Were you able to add file:// as a Trusted Origin on Okta? I didn’t think that was possible. I thought only http:// and https:// was supported.

10

Yes, I was able to add it - specifically file://localhost:{portnumber}

11

@dragos and @mraible do either of you seen any issues with that Trusted Origin?

12

Hi @whodeee

There was a previous issue with adding file:// as extension for the URL, but it has been resolved, so the application should work successfully. :slight_smile:

1 Like
13

Thanks @dragos I thought I saw some mention of that before, but I couldn’t find where.

14

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.