Dropbox connection is always lost on next day or browser restart (fix available)

[schoettl]

Describe the bug

On Firefox and Chromium (Android and Linux Desktop), about a day after I connected to my Dropbox, organice doesn't work anymore:

• Sync doesn't work (takes forever)
• Listing directory content shows a error alert (see screenshots): "There was an error retrieving files!"

This happened the second or third time to me within the last few days.
Sign out and sign in again fixes it for the moment.

To Reproduce
Login with Dropbox and try organice again on the next day.

Screenshots

Desktop (please complete the following information):

• OS: Android / Linux
• Browser: Firefox and Chromium

Solution: See this comment for a fix

[schoettl]

PS: Looks like I have the same problems on Chromium and Chrome on Android. EDIT: not confirmed yet

(And I did not played with any Dropbox auth tokens!)

[munen]

That sounds pretty severe. I cannot check it on my Desktop, because I'm currently logging out and in on four different browsers (all I got^^) for testing various new features.

However, on my iPhone, I haven't logged in or out in a long time. I just checked, and it still works.

Not saying that this is not a bug, because it does sound serious. Since my phone is still logged into to Dropbox, it could be a hard-to-catch bug on our side or an intermittent issue with Dropbox.

We could upgrade the Dropbox SDK. We are on 9.8.0, while 10.31.0 is available. Upgrading the Dropbox SDK was pretty straight forward the last couple of times, but it did take a little time in small changes and testing to make sure that there's no regression.

It's good that you have it on the Desktop, at least, maybe you can see something off in the local state?

Best of luck with the issue! As soon as I get it, I will make sure to also check it out, because it's not a good bug to have.

[munen]

I found the issue. Dropbox is in the process of switching to only issuing short-lived access tokens. They started migrating apps on September 30th 2021. They are releasing it gradually, so some apps may not have been affected until now.

https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/dropbox-exceptions-AuthError-expired-access-token/td-p/580407

TL;DR: I'll be looking into Dropbox refresh tokens.

[munen]

Dropbox documents how to set the "access token expiration" in the developer console: https://dropbox.tech/developers/migrating-app-permissions-and-access-tokens

According to their docs, this is how it should look like:

However, on our app, this option does not exist:

I suppose that the reference installation of organice is not yet affected of this problem. The docs say that all newly given access tokens expire in 4h, unless there's additional logic around refresh tokens (which we do not have). Having said that, I am logged in in multiple browsers and my phone for a long time (weeks at least) and haven't seen such a log out, yet.

That does not mean we shouldn't tackle the issue, of course. Chances are that it'll hit the reference installation at some point, as well.

[munen]

So.. I did spend this afternoon trying to get the new Dropbox authentication flow in. On a high level, I think we have to change from OAuth 1 to OAuth 2 (PKCE). Here are some docs:

• SDK Repo: https://github.com/dropbox/dropbox-sdk-js
• OAuth Guide: https://developers.dropbox.com/oauth-guide
• PKCE: What and Why?: https://dropbox.tech/developers/pkce--what-and-why-
• Single HTML file example: https://github.com/dropbox/dropbox-sdk-js/blob/main/examples/javascript/pkce-browser/index.html
• SDK Docs: https://dropbox.github.io/dropbox-sdk-js/index.html
• Migrating App Permissions and Access Tokens: https://dropbox.tech/developers/migrating-app-permissions-and-access-tokens

Status: So far I failed. I made several attempts at a rewrite, but I didn't get the whole application to run. Partial things like initial requests for authentication did work, though.

However, maybe I failed because the Dropbox app of the reference installation doesn't show the same UI as it should in my last comment. @schoettl Since your Dropbox app wants the new kind of refresh token, and therefore have a higher chance of actually being able to verify the new code, would you like to give this a shot? I've put the current state of my attempt into a PR for reference.

[munen]

For new connections, the Dropbox app for organice.200ok.ch also returns short lived tokens, now. I tried a second time to implement OAuth 2 and PKCE. This works on my machine.

I'm currently logged in with FF and Chromium, so at least something works with the re-implementation. I'll wait until tomorrow to see if I'm still logged in or if there's something amiss.

[schoettl]

Hi munen, thanks for this thorough investigation of the problem! I'm having my final exams the last couple weeks. This Wednesday is the last one!

I can at least help testing your branch overnight with Firefox and Chromium on Desktop.

I encountered a little bug: after signing in with dropbox on your branch, I got the error alert "There was an error retrieving files" (as in my screenshot above). Even if I explicitly logged out before login. After I clicked OK at the alert, everything works fine.

[munen]

Ah, good luck with the final exams 🤞 🎶 💯

Don't let yourself be disturbed, but I'll continue to post updates here for future reference.

I encountered a little bug: after signing in with dropbox on your branch, I got the error alert "There was an error retrieving files" (as in my screenshot above). Even if I explicitly logged out before login. After I clicked OK at the alert, everything works fine.

I have the same about once in 4 tries. Might be a racing condition, but a weird one, because at this point we always should have a valid token..

In any case, the test overnight yields an expired_access_token error for me. So the new initial token retrieval works (with the new bug mentioned in the paragraph above), but doing the refresh doesn't work, yet.

[munen]

I pushed a new version. It might just work. Again, we need to wait and see.

[munen]

I encountered a little bug: after signing in with dropbox on your branch, I got the error alert "There was an error retrieving files" (as in my screenshot above). Even if I explicitly logged out before login. After I clicked OK at the alert, everything works fine.

Thanks for the report. It's fixed, now.