How to debug 'MismatchingStateError'

Hello, i was trying to connect to the OneDrive REST Api using oauthlib. I am able to create an authorization url, but when it comes to fetching a token, my programm throws an exception.

from requests_oauthlib import OAuth2Session


client_id = '3753a627-146e-4137-8f6e-8c561547551b'
client_secret = 'xxxxxxxxxxxxxxxxxxxxxxx'
redirect_uri = 'https://localhost:8080'

#OAuth Endpoints for OneDrive
authorization_base_url = "https://login.live.com/oauth20_authorize.srf"
token_url = "https://login.live.com/oauth20_token.srf"
scope = [
    "offline_access",
    "onedrive.readwrite",
    "wl.signin"
]



onedrive = OAuth2Session(client_id, scope=scope, redirect_uri=redirect_uri)

authorization_url, state = onedrive.authorization_url(authorization_base_url)
print('Authlink,', authorization_url)

redirect_response = input('Please enter the FULL Url: ')
onedrive.fetch_token(token_url, client_secret=client_secret,authorization_response=redirect_response)

C:\Users\Tim\AppData\Local\Programs\Python\Python35-32\python.exe C:/Users/Tim/PycharmProjects/copy+/onedriveconnect.py
Authlink, https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=3753a627-146e-4137-8f6e-8c561547551b&redirect_uri=https%3A%2F%2Flocalhost%3A8080&scope=offline_access+onedrive.readwrite+wl.signin&state=sYQ8Lv2cLpV7QqZyujgfI9d7OmuhPE
Please enter the FULL Url: https://localhost:8080/?code=Mfac93b90-7dda-0c22-4000-8d7cb40ca384&state=sYQ8Lv2cLpV7QqZyujgfI9d7OmuhPE 
Traceback (most recent call last):
  File "C:/Users/Tim/PycharmProjects/copy+/onedriveconnect.py", line 25, in <module>
    onedrive.fetch_token(token_url, client_secret=client_secret,authorization_response=redirect_response)
  File "C:\Users\Tim\AppData\Local\Programs\Python\Python35-32\lib\site-packages\requests_oauthlib\oauth2_session.py", line 187, in fetch_token
    state=self._state)
  File "C:\Users\Tim\AppData\Local\Programs\Python\Python35-32\lib\site-packages\oauthlib\oauth2\rfc6749\clients\web_application.py", line 174, in parse_request_uri_response
    response = parse_authorization_code_response(uri, state=state)
  File "C:\Users\Tim\AppData\Local\Programs\Python\Python35-32\lib\site-packages\oauthlib\oauth2\rfc6749\parameters.py", line 227, in parse_authorization_code_response
    raise MismatchingStateError()
oauthlib.oauth2.rfc6749.errors.MismatchingStateError: (mismatching_state) CSRF Warning! State not equal in request and response.

Process finished with exit code 1

[singingwolfboy]

It appears that there are several different people asking for help in this GitHub issue, with several different issues that are similar, but may have different causes. That makes it really hard to actually help anyone.

I’m going to close this GitHub issue. If you still have a problem that you haven’t been able to resolve, please open a new, separate GitHub issue.

[nilbacardit26]

Actually the issue is “How to debug MismatchingStateError”

I am gonna try to bring some light as I encountered the same issue. I solved it by passing the FULL url in the response in the authorization_response: http://localhost:8090/callback?code=XXX&state=YYY&session_state=ZZZZ Note that the url callback configured in my app is: http://localhost:8090/callback I was not passing http://localhost, just /callback?code=XXX&state=YYY&session_state=ZZZZ And that was causing the oauthlib.oauth2.rfc6749.errors.MismatchingStateError: (mismatching_state) Seems obvious but I just wanted to note that. Besides, check that you state is the same and that there are not encoded characters.