Goodreads OAuth Problems about apps-script-oauth1

[stephaniewilkinson]

Hi! I'm following you over here from goodreads. When you give goodreads the callback URI, it appends ?oauth_token=token&authorize=1 to the end of the URI.

Can you get the other params out of your callback?

If not, then you could save the params from your google script as a variable and append it. You could redirect from the callback url to another URL with the params appended.

Here's how I did it in my app, FWIW (although I wasn't working with two sets of params): https://github.com/stephaniewilkinson/bookmooch/blob/master/app.rb#L36

[erickoledadevrel]

Unfortunately it seems like the Goodreads API isn't following the OAuth 1.0 specification. As per their documentation:

The oauth_callback param value must not contain any query string params.

However, the official OAuth 1.0 specification says:

The callback URL MAY include Consumer provided query parameters. The Service Provider MUST retain them unmodified and append the oauth_token parameter to the existing query.

Apps Script requires a state parameter in the /usercallback URL in order to run. The library is passing this parameter, but Goodreads is blindly appending it's parameters instead of adding them on with ampersands as required by spec.

[erickoledadevrel]

I've been able to work around this bug in their implementation by using the web app URL instead of the normal callback URL, since the web app URL doesn't require any state parameters. I've published a sample that shows how to do this.