OAuth application approval fails for Jetpack site

[cfinke]

Steps to reproduce the issue

1. I enabled my Blog Helper skill in the Alexa skills store (https://www.amazon.com/dp/product/B01N1O4M4G).
2. I clicked "Link Account".
3. I was sent to https://public-api.wordpress.com/oauth2/authorize?client_id=50627&response_type=code&state=[state]&redirect_uri=[redirect_uri]
4. I found my site in the list (chrisfinke.com, running Jetpack with the API and SSO modules enabled), and clicked "Approve."

What I expected

1. That the necessary OAuth information would be passed back to the redirect_uri specified for the app.

What happened instead

I was redirected to the URL https://www.chrisfinke.com/wp-login.php?action=jetpack_json_api_authorization&redirect_to=[long]&data=[misc]&token=[blah]&timestamp=[timestamp]&nonce=[nonce]&body-hash&signature=[sig] (Parameters redacted) and I saw an error screen that said, "Someone may be trying to trick you into giving them access to your site. Or it could be you just encountered a bug :). Either way, please close this window." Since I wasn't trying to trick myself, it must be a bug :).

I disconnected Jetpack and reconnected it with a different account and tried logging in with that account, and that did not work either.

The login process does work for regular WordPress.com blogs, so it doesn't appear to be a problem in Amazon's OAuth implementation.

This was on Jetpack 4.4.2 and WordPress 4.7.

[georgeh]

@cfinke Did you find a workaround to this?

[cfinke]

No, I haven't investigated it any further since submitting the bug report.

[georgeh]

I am seeing this with a Google OAuth2 library on https://artiss.blog/ but it is working for everyone else who is testing. Of note:

• Jetpack JSON API was turned off the first time that he tried to auth, and the system correctly errored. After turning it back on, he started getting the "Someone may be trying to trick you" error
• He is using Authy for 2fa
• He is an a11n
• We have tried disconnecting the app on his account and re-adding it without success

cc @dartiss

[jeherve]

He is using Authy for 2fa

@dartiss Is that the Authy plugin on your self-hosted site? What happens when you deactivate that plugin?

[georgeh]

We did some more debugging. It was actually the Two-Factor plugin that he was using, and disabling the plugin didn't help. A couple things I noticed while debugging:

• He's behind CloudFlare
• A couple calls in Calypso failed and had to be retryed
• Could not find any connectivity problems in the Jetpack debug tool

[jeherve]

Could he check if there are any blocked calls in his CloudFlare interface, in the "Network" tab?

[dartiss]

Did you mean the interface on the CloudFlare website itself? In which case my Network tab only gives me switchable options - there are no references to any blocks.

[jeherve]

That's odd. I assumed the failed calls from Calypso would show up there.

Would you mind enabling WP_DEBUG on your site, try to make the link again, and see if any errors come up in your debug.log?

Thanks!

[dartiss]

I've done that. For the first couple of attempts I got errors to say that it couldn't connect with Jetpack at all. After trying to re-authorise again from scratch I finally got the "someone may be trying to trick you into giving them access to your site" error.

The debug log can be found at https://cloudup.com/cGTnFDZp90S.

[jeherve]

Could you try to deactivate the PollDaddy plugin and give it another try?

[georgeh]

FWIW I just installed the PollDaddy plugin and am still able to connect to my site on Pressable

[dartiss]

I deactivated it but it's still the same error.

[jeherve]

Hm. I'm out of ideas here I'm afraid. I'd suggest pausing CloudFlare for a bit to try without it, just to be sure. If that doesn't help either, we'll need to look deeper.

[georgeh]

Can you generate a new debug log after deactivating PollDaddy? Or possibly deactivating all plugins (other than Jetpack) and seeing if that works?

[somprabhsharma]

we are also getting the same error "Someone may be trying to trick you into giving them access to your site. Or it could be you just encountered a bug :). Either way, please close this window." for one my user's wordpress site http://coxhypnotherapy.com/ during oauth2 flow. any solution for this ?
Also this error message is by jetpack or any other plugin ?

[beaucollins]

@somprabhsharma we're still getting to the bottom of this. From what we can tell the token URL querystring parameter is getting double encoded in some cases before it reaches the oauth login form on the jetpack website and fails this token comparison.