OAuth access token request returns 200 with empty body

[cellog]

I am building a SPA that needs to retrieve repository files from GitHub. As such, I am trying to follow the instructions at:

https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/#web-application-flow

to authenticate a user prior to making API calls.

I have successfully redirected a user, and been returned back with a code.

At this stage: https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/#1-request-a-users-github-identity

The process fails in an odd way. I POST a request using this code:

if (testState === localStorage.getItem("github-state")) {
      // CSRF token matches
      const url = new URL("https://github.com/login/oauth/access_token");
      url.searchParams.append("client_id", "10aab26710e2b7a4baf7");
      url.searchParams.append("client_secret", githubOauthSecret);
      url.searchParams.append("code", code!);
      url.searchParams.append("redirect_uri", "https://8tlsj.csb.app/auth");
      url.searchParams.append("state", testState!);
      fetch(url.toString(), {
        method: "POST",
        mode: "no-cors",
        headers: {
          Accept: "application/json"
        }
      })
        .then(response => {
          return response.json();
        })
        .then(({ access_token }) => {
          localStorage.set("github-access-token", access_token);
          // trigger a re-render
          setAccessToken(access_token);
        });
    }
    localStorage.removeItem("github-state");
  }

Github is responding with success, but the response body is empty. I have tried posting to the endpoint using PostMan as well, and can see that the response is completely empty (which incidentally crashes Postman if you try to view it raw, but that’s another story). Chrome dev tools show “no response”. Here are the response headers:

HTTP/1.1 200 OK
Server: GitHub.com
Date: Sun, 26 Apr 2020 16:08:10 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Status: 200 OK
Vary: X-PJAX
ETag: W/"7118ab2d59f765bf7fd9b58d3dd4d467"
Cache-Control: max-age=0, private, must-revalidate
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com
Vary: Accept-Encoding, Accept, X-Requested-With
Content-Encoding: gzip
X-GitHub-Request-Id: C30E:2C0C:14B801F:1DC4E20:5EA5B1EA

Note: I initially tried posting the params in the body (which is the correct way to do POST), but changed it to sending query parameters when that did not work. The documentation is very ambiguous on this point, it only lists parameters but does not specify whether they should be query parameters or passed as body, it would be great if that could be remedied as well.

There’s 2 issues:

1. I am doing something wrong, and have no idea what, because the headers returned don’t indicate an error, and there is no body.

2. GitHub should NOT return 200 for an unsuccessful request!

Any help appreciated.

[cellog]

Problem is that you can’t do CORS OAuth, so browser will never work. Have to set up a server to do the request, so I cobbled together a little heroku and it works now