Onedrive-api-docs: Problem with old Skydrive scopes mixed with the new OneDrive scopes in my App

[RafaelSermenho]

I have an application that used SkyDrive API. After SkyDrive was replaced I upgraded my code to use OneDrive API.

Looking my application in the dev page (https://account.live.com/consent/Manage) I could notice that the scopes I used with SkyDrive ("wl.offline_access", "wl.signin", "wl.basic", "wl.skydrive", "wl.skydrive_update") and the scopes I used with OneDrive ("onedrive.readwrite", "onedrive.appfolder", "wl.offline_access") were there.

Everything was working until last month, even with all these scopes. But now I'm not being able to upload files. I'm receiving a Bad Request error (Code 400).

I discovered that adding the ""onedrive.readonly" scope fix the upload but I don't know why. I also know that an application with only the OneDrive scopes ("onedrive.readwrite", "onedrive.appfolder", "wl.offline_access") also works.

Does anybody knows what's going on?

[daboxu]

Hi, what's the detail error are you seeing?

[RafaelSermenho]

First, let me give you a better background on my usage ...

Initially I implemented an Android application using Live SDK (https://github.com/liveservices/LiveSDK-for-Android). So for accounts linked through this application, these scopes have been granted : "wl.signin", "wl.basic", "wl.skydrive", "wl.offline_access" and "wl.skydrive_update". This version of my application have used following code :

...
public static final String[] SCOPES = {"wl.signin", "wl.basic", "wl.skydrive", "wl.offline_access", "wl.skydrive_update"};
...
mAuthClient.login(context, SCOPES, new LiveAuthListener() {...}
...

Then after been noticed that Live SDK had been replaced by the OneDrive API (https://github.com/OneDrive/onedrive-sdk-android), I have decided upgrading my application to OneDrive SDK. So I changed my code as the following :

...
public String[] getScopes() {
    return new String[]{"onedrive.readwrite", "onedrive.appfolder", "wl.offline_access"};
}
...
new OneDriveClient.Builder().fromConfig(createConfig()).loginAndBuildClient(context, callback);
...

Then when linking an account that has already been linked using the first version of my application (the one built with Live SDK), I could check that the new scopes have been successfully granted too. However, I found that all requested scopes was there granted for this account : those requested when the account was linked through Live SDK and those requested when the account was linked through OneDrive SDK.

So far, so good. As said before, everything was working fine even for the accounts with all these scopes granted. But since last month, I am not able to upload files using those accounts once linked through Live SDK. I am receiving Bad Request error (Code 400). I have filtered my log by "DefaultHttpProvider|onedrive|error" and found these type of messages :

04-07 13:36:33.437  3073  3405 D AuthorizationInterceptor[intercept] - 71: Intercepting request, https://api.onedrive.com/v1.0/drive/items/859977BDE1900234!493%3A/19700204_12547.jpg%3A/action.createUploadSession
04-07 13:36:33.437  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 219: Starting to send request, URL https://api.onedrive.com/v1.0/drive/items/859977BDE1900234!493%3A/19700204_12547.jpg%3A/action.createUploadSession
04-07 13:36:33.437  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 223: Request Method POST
04-07 13:36:33.437  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 234: Sending com.onedrive.sdk.extensions.CreateSessionBody as request body
04-07 13:36:33.697  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 265: Response code 200, OK
04-07 13:36:33.697  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 301: Response json
04-07 13:36:33.757  3073  3405 D AuthorizationInterceptor[intercept] - 71: Intercepting request, https://api.onedrive.com/up/eyJSZXNvdXJjZUlEIjoiODU5OTc3QkRFMTkwMDIzNCE0OTMiLCJSZWxhdGlvbnNoaXBOYW1lIjoiMTk3MDAyMDRfMTI1NDcuanBnIn0/4mf5bZSDy27PNHGhvn2sZBfv5CWpkJJwtZ9P5kqOMZAX3PvvuRA6Ux0tyfOVi69X8y1hZXyEaD5QbD4q0JOYa-KnN6Wt6QW6YVlv09zcoHcdc/eyJOYW1lIjoiMTk3MDAyMDRfMTI1NDcuanBnIn0/4wP-sW8A90g5JggqvzJ_nP_yASXQNXFMMCH_LRWyPXdw_9FaG-qrvWPNaenmAd_R86gEf9mrYY4C8Cs8vc8UezufIG7zOzGVIDvw9_3xGMTHAf6IH-wlf3kYsXm6yC5pu-nr8sv6-XbRnvkzZYVsg6VUlL3pkjNNGVGGV07OcjcySmHm2dQruCpdyOwgmvREO2SJbE8C/MnB_AO5GjHbQeTDZo-9Q7QiDVVNR9krX_7OekhZLpo9bGfZ4faArsJsnqbIfpceVirnHEPQxzdYlsEuiNxKDomtIC3GimI24ewo6fh9sNtLUegUL2dAzX2MLHcOWYnRP3lBD6urEi44ZhQowE9EZagmDUGne_jUSmfyqh4sL6WN0fEJtgWz118ds4SeUFHnok4GUY4ji/cf2u8OGMJrTMXVrK8PtyhrOnVOR1jM-OjvMJq1WGFdHHKO8vi78POJT-RFs-HR3xQirkIc6btVc38KKRB2yg_8x680Kk5R9mvSXE2NJyttpzMjM2E8w-Z4WltQLFmTwFGItjSzLZPaAybDsU-GkMTY14rOjknkbP1EiJnjEHzpaO-vxlC8eKZXNp5QEzoR-HZTcr6DvA%00?%40name.conflictBehavior=replace
04-07 13:36:33.757  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 219: Starting to send request, URL https://api.onedrive.com/up/eyJSZXNvdXJjZUlEIjoiODU5OTc3QkRFMTkwMDIzNCE0OTMiLCJSZWxhdGlvbnNoaXBOYW1lIjoiMTk3MDAyMDRfMTI1NDcuanBnIn0/4mf5bZSDy27PNHGhvn2sZBfv5CWpkJJwtZ9P5kqOMZAX3PvvuRA6Ux0tyfOVi69X8y1hZXyEaD5QbD4q0JOYa-KnN6Wt6QW6YVlv09zcoHcdc/eyJOYW1lIjoiMTk3MDAyMDRfMTI1NDcuanBnIn0/4wP-sW8A90g5JggqvzJ_nP_yASXQNXFMMCH_LRWyPXdw_9FaG-qrvWPNaenmAd_R86gEf9mrYY4C8Cs8vc8UezufIG7zOzGVIDvw9_3xGMTHAf6IH-wlf3kYsXm6yC5pu-nr8sv6-XbRnvkzZYVsg6VUlL3pkjNNGVGGV07OcjcySmHm2dQruCpdyOwgmvREO2SJbE8C/MnB_AO5GjHbQeTDZo-9Q7QiDVVNR9krX_7OekhZLpo9bGfZ4faArsJsnqbIfpceVirnHEPQxzdYlsEuiNxKDomtIC3GimI24ewo6fh9sNtLUegUL2dAzX2MLHcOWYnRP3lBD6urEi44ZhQowE9EZagmDUGne_jUSmfyqh4sL6WN0fEJtgWz118ds4SeUFHnok4GUY4ji/cf2u8OGMJrTMXVrK8PtyhrOnVOR1jM-OjvMJq1WGFdHHKO8vi78POJT-RFs-HR3xQirkIc6btVc38KKRB2yg_8x680Kk5R9mvSXE2NJyttpzMjM2E8w-Z4WltQLFmTwFGItjSzLZPaAybDsU-GkMTY14rOjknkbP1EiJnjEHzpaO-vxlC8eKZXNp5QEzoR-HZTcr6DvA%00?%40name.conflictBehavior=replace
04-07 13:36:33.757  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 223: Request Method PUT
04-07 13:36:33.757  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 229: Sending byte[] as request body
04-07 13:36:33.887  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 265: Response code 400, Bad Request
04-07 13:36:33.887  3073  3405 D DefaultHttpProvider[sendRequestInternal] - 270: StatefulResponse is handling the HTTP response.
04-07 13:36:33.887  3073  3405 D ChunkedUploadResponseHandler[generateResult] - 107: Receiving error during upload, see detail on result error

I am still using same code that was working last month :

...
BufferedInputStream fileStream = new BufferedInputStream(new FileInputStream(tmpFile));
ChunkedUploadSessionDescriptor sessionDescriptor = new ChunkedUploadSessionDescriptor();
sessionDescriptor.name = tmpFile.getName();

final Item itemPath = new Item();

itemPath.parentReference = new ItemReference();
itemPath.parentReference.id = oneDriveFolder.getFileId();
itemPath.name = tmpFile.getName();

        try {
            mClient.get()
                    .getDrive()
                    .getItems(itemPath.parentReference.id)
                    .getItemWithPath(tmpFile.getName())
                    .getCreateSession(sessionDescriptor)
                    .buildRequest()
                    .post()
                    .createUploadProvider(mClient.get(), fileStream, (int) tmpFile.length(), Item.class)
                    .upload(Collections.singletonList(option),
                            new IProgressCallback<Item>() {...}
        }
...

So in my debug, I came across on a strange situation using "onedrive.readonly" scope that really made me worried ...

Fresh accounts never linked before will work fine when they are linked for the first time using OneDrive scopes ("onedrive.readwrite", "onedrive.appfolder", "wl.offline_access"). But here lies my question : _why old accounts (those once linked through Live SDK) are not working when they are linked through OneDrive SDK using these same scopes ?_

I found that if I use one of these failing accounts (account once linked through Live SDK) but now additionaly asking for the scope "onedrive.readonly", it works. I mean the following :

...
public String[] getScopes() {
    return new String[]{"onedrive.readwrite", "onedrive.appfolder", "wl.offline_access", "onedrive.readonly"};
}
...
new OneDriveClient.Builder().fromConfig(createConfig()).loginAndBuildClient(context, callback);
...

But I think going this way is not safe as it is not documented in the OneDrive SKD API web site. And moreover, it sounds like a inconsistency situation asking for both onedrive.readwrite and onedrive.readonly.

[daboxu]

hi @RafaelSermenho no worried, definitely there is some change at server side cause the bug, I saw the upload url is very stange
https://api.onedrive.com/up/eyJSZXNvdXJjZUlEIjoiODU5OTc3QkRFMTkwMDIzNCE0OTMiLCJSZWxhdGlvbnNoaXBOYW1lIjoiMTk3MDAyMDRfMTI1NDcuanBnIn0/4mf5bZSDy27PNHGhvn2sZBfv5CWpkJJwtZ9P5kqOMZAX3PvvuRA6Ux0tyfOVi69X8y1hZXyEaD5QbD4q0JOYa-KnN6Wt6QW6YVlv09zcoHcdc/eyJOYW1lIjoiMTk3MDAyMDRfMTI1NDcuanBnIn0/4wP-sW8A90g5JggqvzJ_nP_yASXQNXFMMCH_LRWyPXdw_9FaG-qrvWPNaenmAd_R86gEf9mrYY4C8Cs8vc8UezufIG7zOzGVIDvw9_3xGMTHAf6IH-wlf3kYsXm6yC5pu-nr8sv6-XbRnvkzZYVsg6VUlL3pkjNNGVGGV07OcjcySmHm2dQruCpdyOwgmvREO2SJbE8C/MnB_AO5GjHbQeTDZo-9Q7QiDVVNR9krX_7OekhZLpo9bGfZ4faArsJsnqbIfpceVirnHEPQxzdYlsEuiNxKDomtIC3GimI24ewo6fh9sNtLUegUL2dAzX2MLHcOWYnRP3lBD6urEi44ZhQowE9EZagmDUGne_jUSmfyqh4sL6WN0fEJtgWz118ds4SeUFHnok4GUY4ji/cf2u8OGMJrTMXVrK8PtyhrOnVOR1jM-OjvMJq1WGFdHHKO8vi78POJT-RFs-HR3xQirkIc6btVc38KKRB2yg_8x680Kk5R9mvSXE2NJyttpzMjM2E8w-Z4WltQLFmTwFGItjSzLZPaAybDsU-GkMTY14rOjknkbP1EiJnjEHzpaO-vxlC8eKZXNp5QEzoR-HZTcr6DvA%00
because it has a %00 at the end which cause the uploading work failed, I will investigate more in this case and give you update on this issue. Right now it seems adding onedrive.readonly is the easiest work around for you, sorry for the inconvenience.

[RafaelSermenho]

Hi @daboxu! Thanks for your reply.
Do you have any update on the investigation above?

[daboxu]

@RafaelSermenho we are still investigating the root cause

[rafasimionato]

Hi @daboxu, I am seeing this very same issue reported by @RafaelSermenho. My application is deployed for more than 17K users but I don't know how many of them are impacted by this situation. So I would appreciate a quick fix for this issue to avoid people giving away using my application.

[daboxu]

@rafasimionato really sorry for the impact on your app and we are trying our best to fix the issue as soon as possible, in the meantime, have you tried adding onedrive.readonly as a working around. I will let you know once we push the fix in.

[rafasimionato]

Hi @daboxu, I really appreciate your prompt reply on this issue.

I have tried the mentioned work-around but I am afraid of deploying a fix like this as it is not in the official API documentation. I only could found that to use One Drive APIs I should ask for scopes "onedrive.readwrite", "onedrive.appfolder" and "wl.offline_access".

I am worried about the risks of using both onedrive.readwrite and onedrive.readonly. It seems a contradictory situation. Is it safe to use these both scope simultaneously ?

[daboxu]

@RafaelSermenho @rafasimionato hi, the issue should be gone, could you please verify that works for you? Sorry for taking too long for this.

[rafasimionato]

Hi @daboxu, first I would like to thank you for working on this issue. It got back working fine using One Drive scopes in an account that previously requested legacy Live SDK (https://github.com/liveservices/LiveSDK-for-Android) scopes. However, an older version of my app which supports only legacy Live SDK scopes is no longer working.

Could you please confirm if has the legacy Live SDK API/service been completely turned off ?

[daboxu]

@rafasimionato yeah, the SDK is very old, please try Micrsoft Graph SDK for Android.

[rafasimionato]

Hi @daboxu, no problem. I have already replaced LiveSDK by OneDrive API in this app. I was just wondering figure out why this old app version (already deployed @ GooglePlay) was not working. Anyway, this app will be updated in users devices sooner or later.

[daboxu]

@rafasimionato you should blame me for this but our API has moved way faster than the SDK used be so it is a good idea for upgrading it. Sorry for the inconvenience. I closed the issue for now and feel free to open it if you have any questions.

[rafasimionato]

Now problem, tks for your support on this.