Question

I use Omniauth to let users login with Github.

Step 1. The user is sent to /auth/github and then redirected to github to login.

Step 2. The user authenticates itself and Github return this string and a code parameter:

<# extra=# private_gists=0 public_gists=0 public_repos=0 total_private_repos=0 type="User" url="https://api.github.com/users/XXXXX">> info=#> provider="github" uid=13XXXXX>

params[:code] = CODEXXXXXXXXX

Step 2. Then, I try to retreive the token by sending a post request to :

https://github.com/login/oauth/access_token

with parameters: client_id, client_secret and the code received in step 1 but I get 404.

Question 1: Are these steps correct or am I missing something ?

Question 2: What are the parameters that I need to save in the database to authenticate after successful login (I use a User model).

Answer 1

If you are using Omniauth, you should just point the user to

"/auth/github"

and then set a route like this:

match '/auth/:provider/callback', :to => 'sessions#create'
match '/auth/failure', :to => 'sessions#failure'

Omniauth will handle everything else and you will be returned a hash with all the user information.

Then to get the access token, you have to submit a post request as follows:

POST https://github.com/login/oauth/access_token?
client_id=...&
redirect_uri=http://www.example.com/oauth_redirect&
client_secret=...&
code=...

I think you are missing the redirect_uri, so GitHub is redirecting by submitting a GET request to https://github.com/login/oauth/access_token, which returns a 404 error.