Hello world,
I’m writing some code trying to integrate Box Java SDK into my own Android Java code.
The URL to invoke Box OAuth2 is built using code like below
BoxAPIConnection.getAuthorizationURL(clientId, URI.create("oauth://box.oauth2/redirect"), state, scopes)
Whereas state is a random UUID string and scopes is just root_readonly. Using some non-standard protocol name here since I expect app deeplinks will capture the above redirect, then I will be processing the redirect callback in my code to get the access token.
However, upon invoking the above code, my Android code isn’t capturing the deeplink URL at all. Traced down a bit revealed the URL returned by box.com server is being
https://app.box.com/login/mfa?redirectUrl=%2Fapi%2Foauth2%2Fauthorize%3Fclient_id%3D<REDACTED>%26response_type%3Dcode%26redirect_uri%3Doauth%253A%252F%252Fbox.oauth2%252Fredirect%26state%3D<REDACTED>%26scope%3Droot_readonly#
That made box came to nowhere but a missing page.
I thought I should expect redirect_uri should be at most oauth%3A%2F%2Fbox.oauth2%2Fredirect in order for the platform to trigger the redirect at the browser properly, then the deeplink trigger, to hand back control back to my Android code?
May anyone shed some light to confirm I’m missing something here?
